I have some log data that uses timestamps in an epoch-like format, but the issue is that they are logged as if it were in a local timezone rather than UTC. For example, 1394203884 = 14:51:24 March 6 2014 PST.
For example:
ts="1394187680", ...
ts="1394187682", ...
ts="1394187682", ...
ts="1394187682", ...
I understand that this an epoch-like forma and should always refer to UTC, but in this case it does not. Is there any way to configure Splunk to use these fields as timestamps, but not assume that they are UTC?
Update:
I should have mentioned this in the original post, I will update it. I have tried this(props.conf) and use it with other inputs, but Splunk does not seem to apply any TZ settings in this case. I believe this is because it identifies the timestamp as epoch time and assumes it is in UTC.
... View more