splunk shows time 4 hours behind.

[kamalbeg]

I am getting some data from docker application. Client is telling me that in his log file the time stamp is up to date but when it comes to splunk, its 4 hours behind.

On indexer, I have created the props.conf file and have the following entry

more props.conf
[source::/var/tmp/log/*]
TZ = US/Eastern

How can I fix this?

[bcyates]

It sounds like the timestamp coming over is in UTC. Change your props to account for the difference.

[source::/var/tmp/log/*]
TZ = UTC

[kamalbeg]

Both the client server and splunk servers are in EST

[cmerriman]

what is the user time zone set as?