Splunk Cloud operates in the UTC time zones. Data could come in from any of 23+ other time zones so trying to get them to match is futile. The correct process is to tell Splunk what time zone the d...
See more...
Splunk Cloud operates in the UTC time zones. Data could come in from any of 23+ other time zones so trying to get them to match is futile. The correct process is to tell Splunk what time zone the data is from and let it adjust it to the system time. Do that using props.conf. The best method to use depends on the data itself. See the Admin Manual's description of the TZ setting for more information. The algorithm for determining the time zone for a particular event is as
follows:
* If the event has a timezone in its raw text (for example, UTC, -08:00),
use that.
* If TZ is set to a valid timezone string, use that.
* If the event was forwarded, and the forwarder-indexer connection uses
the version 6.0 and higher forwarding protocol, use the timezone provided
by the forwarder.
* Otherwise, use the timezone of the system that is running splunkd.