I'm running splunk in windows where the time is in PST.
I read logs in GMT time, so when I search for most recent, it yields 0 results because all my data is indexed in GMT time (technically in the future).
Example:
IIS log
2011-08-02 23:42:01 W3SVC1...
But current time on system is 4:42 PM PST.
So when I issue a search for the current time, it searches and returns for data at 4:442PM PST, not 4:42PM GMT.
Is there a work around for this?
... View more