Using IIS FTP Server, Server 2008 RC2. FTP log format is W3C (UTC Timestamps). Splunk pulls the logs (entries) in just fine, however the time is wrong, that is, there's no conversion from UTC to US/Pacific.
I've looked on this forum and Google and tried modifying the /etc/system/local/props.conf file in the following way (btw: splunk is also running on Windows Server 2008 RC2):
[iis_ftp]
TZ = Etc/UTC
[iis]
TZ = Etc/UTC
AND ...
[sourcetype::iis_ftp]
TZ = Etc/UTC
[sourcetype::iis]
TZ = Etc/UTC
Neither works, no conversion to US/Pacific (or my local timezone). I of course restarted splunk after modifying props.conf. I've looked at the following:
http://splunk-base.splunk.com/answers/9666/iis-log-timezone
http://splunk-base.splunk.com/answers/1425/timezones-iis-w3c-extended-logging-why-dont-they-work
http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/ApplyTimezoneOffsetstotimestamps
http://splunk-base.splunk.com/answers/28442/log-time-differs-from-time-on-splunk-host
This to me should be an obvious no-brainer and a VERY common topic. Perhaps I've misread something in those articles -- just doesn't work. Any solutions? Thanks, J.
... View more