timezone question

[a212830]

Hi,

I have a feed that sends messages using the UTC timezone. The timezone itself is never listed, but the vendor has assured me that this is the case (and it looks correct). Should I reference the timezone with a "TZ = UTC" in props.conf, or should I put a %T in the TIME_FORMAT, even though the timezone isn't in the message.

For example:

2014-01-14 23:54:17 1.2.3.4 message....

My props.conf has:

TIME_FORMAT = %Y-%m-%d %H:%M:%S
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TZ = UTC

or should it have:
TIME_FORMAT = %Y-%m-%d %H:%M:%S %T
SHOULD_LINEMERGE = false
TIME_PREFIX = ^

Update: it appears to be ignoring my timezone, regardless. As the event times are matching what is in the logs, and that should not be the case.

[lukejadamec]

Try setting MAX_TIMESTAMP_LOOKAHEAD = 20 in your props.conf. That will keep Splunk from trying to interpret 1.2.3.4 as the TZ.

[lukejadamec]

What is your user default timezone? Splunk will adjust the search results based on the user timezone.
If no timezone is available in the event, then Splunk uses the indexer timezone. What is the indexer timezone?