Thanks - this was perfect! ... View more

You could just specify your custom time extraction in props.conf http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf Use the TIME_FORMAT property to specify a strptime pattern for your events. ... View more

There is a great article on the Splunk wiki: Where do I configure my Splunk settings The timezone setting goes in props.conf. It MUST be set where the data is parsed, so that means the heavy forwarders AND the indexers. See this answer from S Sorkin; all Sorkin answers are definitive. ... View more

I just manually accepted this old answer for ya @dwaddle ... View more