I have the following props configuration: [log_files]
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = true
TRUNCATE = 0
KV_MODE = true
pulldown_type = true
TRANSFORMS_FIELDS = data,time
TIME_FORMAT = %Y-%m-%d %H:%M:%S My log files contains IIS logs as follow: 2020-01-22 12:00:37 ::1 GET /test - 80 ::1 Mozilla/5.0+(Windows+NT+6.1;+Win64; x64;+rv:47.0)+Gecko/20100101+Firefox/47.0 - 200 2 5 100 Splunk indexing this file with incorrect time, I got event with time 15:00:07 instead 12:00:37 (and I see another field date_zone=-180), How can I make splunk index event with original the time from the logs file? NOTE: I don't know the logs timezone .
... View more