I have a situation with ingestion latency that I am trying to fix. The heavy forwarder is set to Central Standard Time in the front end under preferences.
Does the front end setting have any bearing on the props.conf
Hi @richgalloway thank you for the input. Do you have documentation references that you can point to?
The docs at https://docs.splunk.com/Documentation/Splunk/latest/Data/Applytimezoneoffsetstotimestamps#How_Splunk... specify how Splunk determines the time zone for an event. Note that the UI setting is not included.
The preferences setting in the UI only affects how times are displayed in the UI. It has no effect on props.conf or the data flowing through the HF.
