https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-timezone-settings-properly/m-p/109247#M22972 <P>what is your <CODE>date_zone</CODE> field's value for these events? If it is "+300" then it is working. I do not understand what you mean when you say "I see ... in the _time field"</P> Tue, 19 May 2015 17:40:30 GMT woodcock 2015-05-19T17:40:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-timezone-settings-properly/m-p/109246#M22971 <P>I have indexer in UTC+3 timezone and universal forwarder on syslog server in UTC+6 timezone. I tried to set up timezone recognition and set <CODE>TZ = Asia/Novosibirsk</CODE> in props.conf for <CODE>[sourcetype::syslog]</CODE>.</P> <P>But when I'm trying to search events (user which I use also has UTC+3) time setting I see UTC+6 time in <CODE>_time</CODE> field.</P> <P>Please help me to fix this.</P> Thu, 22 Jan 2015 17:08:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-timezone-settings-properly/m-p/109246#M22971 ArsenyKapralov 2015-01-22T17:08:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-timezone-settings-properly/m-p/109247#M22972 <P>what is your <CODE>date_zone</CODE> field's value for these events? If it is "+300" then it is working. I do not understand what you mean when you say "I see ... in the _time field"</P> Tue, 19 May 2015 17:40:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-timezone-settings-properly/m-p/109247#M22972 woodcock 2015-05-19T17:40:30Z