Splunk and timezones

[tb5821]

In our splunk instance I believe the props.config file is set to UTC as that is what most of our logs are in but we do have some that are in the local time zone. Since I do not have access to edit the props file is there a way to specify in search that all these logs should be considered EST?

[gkanapathy]

Not really. You can of course compute the difference yourself, but the timestamp (along with host/source/sourcetype, and event breaks) is one of the only things that actually needs to be specified correctly when the data is indexed. Basically, if you don't index with the correct time zone (which means the correct time) then the data can't be found under the correct time. Your admin needs to fix the input data, as basically right now, it's wrong.

[linu1988]

If you can calculate and evaluate the time difference, the search result will come as you want.