Event time inconsistency

[shangshin]

Hi,
I have a stanza below defined in transforms.conf.

[wip_fields]
DELIMS = ","
FIELDS = timestamp,wip,vip

Strangely, the event time is not consistent with the timestamp in each record. It seems the event time is always 5 hours ahead of the timestamp. I suspect I need to set the timezone explicitly? Please share some thoughts or suggestion. Thanks!

table _time,timestamp

8/20/12 4:30:17.000 AM  08/20/2012 09:30:17

[dwaddle · Accepted solution]

If the system parsing the events (normally the indexer, but could be a heavy forwarder) is in a different timezone than the data being indexed, then you will need to provide a TZ offset. Use a props.conf config entry of the form:

[sourcetype]
TZ=America/Chicago

This is an index-time setting so you will have to reload previously indexed data.