Since all events are stored according to their GMT time, the time zone of event only matters at parse time, but it is vital to get it right. Once the event is written into the index, it cannot be changed without reindexing the raw data.
The time zone can come from a number of places, in the following order of precedence:
- The time zone specified in the log. For instance, the date 2012-02-07T01:03:23.575-0600, -0600 indicates that the zone is 6 hours behind GMT. Likewise, Tue 02 Feb, 01:03:23 CST 2012 represents the same date.
- The configuration associated with a source, host, or sourcetype, in that order. This is specified in props.conf. This can actually be used to override the time zone listed ...
