Timezone conversion issue Raw Text Data (UTC) to Splunk Index (EST)

[atul_jain]

I am sure this question is asked numerous times and there are number of answers around this but for some reason its not working for us.
So, we have an IIS log (w3c) which logs data in Text file in UTC format like "2018-05-02 18:30:00 xx.xx.xx.xx POST /abc/xyz"

The Problem, this log is in UTC and all our users and servers are in EST. While searching or building dashboard, it gets tough to work on two timezone. All other data on servers are in EST.

What we want, along with all data in EST the IIS log should come in Splunk index as EST.

What we tried, we tried query level conversion but thats not efficient enough. Tried Props.conf as suggested in various answers with below formats one by one and none actually helped. Please confirm if we are doing it right..
TZ=UTC
TZ=America/Santiago
TZ=GMT+04:00
TZ=US/Eastern etc

Raw Data: 2018-05-02 18:30:00 xx.xx.xx.xx POST /abc/xyz
Expected Data in Splunk:
_time:14:30:00; Data:2018-05-02 18:30:00 xx.xx.xx.xx POST /abc/xyz

[woodcock]

You are looking at this all wrong. You shouldn't care what shows up in the log, only that Splunk can properly understand it. That is what the settings in props.conf do. If you KNOW that the TZ for the TZ-lacking timestamp is US/Eastern, then put that into props.conf for those hosts and deploy that ALL of your Indexers/HFs and reboot Splunk there. Now the _time value will be correct, regardless of what is in the event, and all Splunk operations work with _time.

[atul_jain]

Possibly 🙂
i am the IIS guy and was assisting Splunk team in setting it up. It looks like the Propagation was not working for some reason. Setting it to TZ=UTC helped. thanks for suggestion.

[woodcock]

OK, you should go ahead and click Accept to close the questions and let others know that there is a solution here.

[FrankVl]

And since you know the logs are in UTC, a correctly deployed props.conf with

[your sourcetype here]
TZ = UTC

should do the trick. Why your attempt to already implement that failed is another question. Maybe you didn't define the stanza properly, or didn't put it in the right place?

[atul_jain]

thanks, this worked.

[xpac]

Or didn't restart Splunk 😉

[woodcock]

Or checked events from before the change, which should/will NOT be effected by the change; only events that are indexed after the change will show the change.

[ssadanala1]

I think this post answers your question

https://answers.splunk.com/answers/4279/timezone-and-timestamp-modification-at-search-report-time.ht...

Happy Splunking !!