Splunk Enterprise

How to adjust timestamp for some events sending by UF

NoSpaces
Communicator

Hello for everyone!
I have an UF installed on an MS Exchange server that sends data to the indexer layer
Search actions performed on SearchHeads
All events in the IIS file log (MS Exchange) look like this:
2023-08-22 11:16:36 172.25.57.29 POST bla bla bla...

As you see, a timestamp doesn't have any data about timezone, and on SearchHeads, I see that events are older by 3 hours than I expected to see

I read some questions and documentation about how to adjust the TImeZone and tried to set up props.conf on the UF by setting "TZ = UTC"
Also, I tried another variation, but timestamps didn't change

Another way that I tried is to use "EVAL-_time = _time + 10800"
But this attempt failed too

I think that it is a really common problem, but maybe I missed something and can't solve it. Can anyone help me with this stupid question?

Labels (1)
0 Karma

NoSpaces
Communicator

UP

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...