Hi - I had splunk import a fairly simple two column file - column 1 was a date/time column2 is some info... the problem seems to be that some of the values in column 1 are in EST and some are in UTC.
I don't think splunk is interpreting these correctly - is there a way I can verify this?
02/07/18 03:55:00 PM EST String=2 02/07/18 03:55:04 PM EST String=3 02/07/18 03:55:08 PM EST String=0 02/09/18 11:10:01 PM UTC String=1 02/09/18 11:10:04 PM UTC String=0 02/09/18 11:10:07 PM UTC String=0
So, your sample data already has mixed timezones? Or is that sample data representative of how Splunk parsed it? If the latter, can you include the actual CSV prior to having Splunk handle it?
If column 1 has time zone information in it ("EST", "UTC", "-0500", "Z", or similar) then your props.conf settings can be tweaked to interpret times correctly. If not, do you have any control over how the file is written?
Automatic doesn't always work like it should, as you've discovered. If you can post some sample events (with private into masked) we can help with the right props settings.
Try these props.conf settings.
TIME_PREFIX = ^ TIME_FORMAT = %m/%d/%y %H:%M:%S %p %Z MAX_TIMESTAMP_LOOKAHEAD = 25 LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false
"reindeer"? Is that auto-correct for re-index? If so, yes, you need to re-index the data for the new props to be applied.