Forwarder is in US/Pacific and splunk indexer is in EST. Where do I need to set the timezone so _time has the correct time when I search for events.
Example..logfile tmp/SQL_IO_Write_stats.sigsfpip1.run.log looks likes this (right now it runs 10min after the hour) and logs the IO for each DB into this file.
Aug 23 2011 04:10PM 5 HALO 113326168 103536 14318436352 66323611648 00000000000007a8 1
Aug 23 2011 04:10PM 7 Matrics 78072770 54788 7857946624 41943040000 00000000000007a0
[default]
host = myhost
[monitor:///tmp/SQL_IO_Write_stats.sigsfpip1.run.log]
crcSalt =
on searches host="myhost"
_time shows
8/23/11 4:00:00.000 AM
For timezone, you do not have a choice; for some other settings, you do. You must set the timezone where the parsing occurs. See this definitive answer from S Sorkin. I second rroberts recommendation of the Where do I configure my Splunk settings?
Check out this document:
http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F
I also have that same question, is it better to do the TZ on the universal forwarder, the indexer, or the search head?