When incoming summary data is being processed (e.g. from the collect command), the associated sourcetype is initially "stash_new". After the staging of this data is complete, it then is transformed to the sourcetype "stash". Also of interest, this also means that any setting of TZ done under the "stash" sourcetype will get clobbered in that tranformation. This explains the workaround/solution provided in the following post: https://answers.splunk.com/answers/717448/why-does-setting-a-tz-for-sourcetype-stash-not-tak.html?minQuestionBodyLength=80 ... View more

Solution: Apply the TZ setting in props for the sourcetype "stash_new" instead of "stash" Also, an enhancement request has been submitted for this so a more elegant way of achieving this may be available in future Splunk versions (ref. SPL-161638) ... View more

Hello rakeshksingh, From your Splunk Cloud UI, launch the "Universal Forwarder" app and this will bring you to a page with instructions on how to configure forwarding to your Splunk Cloud instance. This includes a link to a credentials package that you will need to download and install onto each forwarder (this is essentially an app which sets up your outputs.conf to point to the Splunk Cloud indexer cluster and also has the required security certificates). Please note also that applies also to Splunk Enterprise instances (e.g. Heavy Weight Forwarders) that you would like to use to forward data to Splunk Cloud (i.e. this is not only just for configuring Universal Forwarders). And here is a link to document page that is a good starting point for configuring this: https://docs.splunk.com/Documentation/Forwarder/7.2.3/Forwarder/HowtoforwarddatatoSplunkCloud Cheers ... View more