I am getting some data from docker application. Client is telling me that in his log file the time stamp is up to date but when it comes to splunk, its 4 hours behind.
On indexer, I have created the props.conf file and have the following entry
more props.conf
[source::/var/tmp/log/*]
TZ = US/Eastern
How can I fix this?
It sounds like the timestamp coming over is in UTC. Change your props to account for the difference.
[source::/var/tmp/log/*]
TZ = UTC
Both the client server and splunk servers are in EST
what is the user time zone set as?