I'm running splunk in windows where the time is in PST.
I read logs in GMT time, so when I search for most recent, it yields 0 results because all my data is indexed in GMT time (technically in the future).
Example:
IIS log
2011-08-02 23:42:01 W3SVC1...
But current time on system is 4:42 PM PST.
So when I issue a search for the current time, it searches and returns for data at 4:442PM PST, not 4:42PM GMT.
Is there a work around for this?
This page explains how to set up Splunk’s props.conf to convert data sources from a specified time format: Specify Timezones of Timestamps
Example: to set all IIS sources to be imported from UTC, add:
[sourcetype::iis]
TZ = Etc/UTC
This assumes that your IIS logs have a sourcetype of "iis" - adjust appropriately for your system.