I have an entry in props.conf for TZ conversion i.e:
TZ = UTC
If the host is running the universal forwarder the splunk indexer with handle the conversion and display entry using local time.
If I forward logs from host via syslog the indexer does not do the time conversion.
So I'm interpreting this as two separate configurations:
In the second configuration, the props.conf stanza won't apply as it's specifying the remote host, while the syslog data is being monitored locally (and thus would have the indexer as the host)
In the second scenario, I would recommend using sourcetype or source stanzas to apply the TZ setting, not host. As setting it for the indexer would apply the TZ setting to everything indexed locally. (Including _internal logs) Instead, create a source stanza or sourcetype stanza. (Whichever is most appropriate) and use that.
[source::syslog] TZ = UTC
if your source name is different, then change accordingly.
To clarify: I edited the props.conf on the indexer. The remote host(s) is forwarding syslog to indexer via syslog-ng. Indexer is receiving logs. I have over 200 systems forwarding via syslog and not all are using same TZ. SOme are EST and some are GMT
That makes things more complicated. You're going to want to use a transform to get the appropriate host values out of the individual log lines, then host:: stanzas with the relevant TZ settings. However, I'm not sure if this can be done in one props.conf, or if a heavy forwarder is needed. (HF does the transform portion before forwarding to the indexer)
Can't syslog-ng include timezone in the timestamp of the logs? That would take care of things too. (Although that might not be something you control)