Disface on "_time" variable on SPLUNKFORDWARD

[gbriones]

Hi,

I have a problem and I can review event exists a disface between variable time extract and "_time" on SPL

file:

T_LOGFILE_VORDEL_ANSWER_SLA10_1;0;08/25/2021 09:03:08

on SPLUNK

[richgalloway]

Verify the time zone is set correctly in your Splunk preferences.

Verify the data is onboarded correctly.  Check props.conf for the correct TIME_FORMAT setting.  Add a TZ setting so Splunk knows the time zone in which the event was generated.

[gbriones]

add on props.conf and still the problem:

...
disabled=false
pulldown_type=true
TZ=America/Santiago
TIME_FORMAT = %m/%d/%Y %H:%M:%S