We are receiving events on our syslog collector in UTC timezome. Below is the sample event.
I have configured the below props on our search head, My assumption was it will pick the searchhead timezone while showing the events in SH.but it is not converting the timezone to CT
[sourcetype]
DATETIME_CONFIG = CURRENT
Oct 8 13:59:00 x.x.x.x [Audit] User xxxxlogged in on the web GUI interface.
↧