how do I skip the timezone inside the timestamps

[cyue_splunk]

I got a sample log with timestamp format like this:

Thu Dec 20 20:45:24 CST 2012

The CST here means China Standard Time (+8). But Splunk recognize this time zone as US Central Time(-6), so the event timestamp I got is Dec 21 10:45:24 am (with my local system also in +8 timezone). No matter how I set the Timeformat in props.conf to skip the CST timezone, the timestamp won't change. Any idea how I can fix this timezone issue?

[cyue_splunk]

I actually also tried to resort the "timezone" with the "year" as described here, but the result won't change.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition#Reconfigure_ho...

My current workaround is to modify the datetime.xml to remove the CST from the zone list.

[Damien_Dallimor · Accepted solution]

In props.conf you can specify the time format that you want applied to your event timestamps.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition#Edit_timestamp...

Can you post the strptime pattern you are specifying..maybe it has an error ?

[cyue_splunk]

This is the correct one. Thanks, Damien!

TIME_FORMAT = %b %d %H:%M:%S CST %Y

[cyue_splunk]

I used this:
TIME_FORMAT = %b %d %H:%M:%S \w+ %Y