https://community.splunk.com/t5/Splunk-Cloud-Platform/splunk-search/m-p/526680#M292 When you are defining input correctly to recognize time zone then it has stored as GMT time and then you could see it as your current time zone has defined on your personal setting.<BR />r. Ismo Tue, 27 Oct 2020 16:36:14 GMT isoutamo 2020-10-27T16:36:14Z https://community.splunk.com/t5/Splunk-Cloud-Platform/splunk-search/m-p/526663#M291 <P>Hi</P><P>&nbsp;</P><P>Suppose the device that sent the log to Splunk is logging in US Pacific time. If I run a search like this in splunk:<BR /><BR />sourcetype=blah Data="*blahdata*" | table _time, Action, Data, Username</P><P>In reviewing the output of the search,</P><P>Is _time in US Pacific or the default UTC?&nbsp;&nbsp;</P> Tue, 27 Oct 2020 15:14:49 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/splunk-search/m-p/526663#M291 trojan_81 2020-10-27T15:14:49Z https://community.splunk.com/t5/Splunk-Cloud-Platform/splunk-search/m-p/526680#M292 When you are defining input correctly to recognize time zone then it has stored as GMT time and then you could see it as your current time zone has defined on your personal setting.<BR />r. Ismo Tue, 27 Oct 2020 16:36:14 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/splunk-search/m-p/526680#M292 isoutamo 2020-10-27T16:36:14Z