I am having the same issue described here http://answers.splunk.com/answers/57543/splunk-displaying-events-with-the-correct-timezone.html.
My indexer is in EST and my syslog is coming from MST. I want the the indexer to change the logs from MST to EST. I have tried the suggested solution and that didn't solve the problem. Any other suggestions.
Thanks in advance.
The problem is likely that you have overriden the host
field and are trying to use your overriden/new host
value in your props.conf
stanza definition. This will not work. You must either use your original host
value or use something else, such as sourcetype
or source
.