https://community.splunk.com/t5/Getting-Data-In/How-to-set-SplunkWeb-not-follow-local-timezone/m-p/19336#M2732 <P>You need to make sure to specify what the timezone of the data is, using the <CODE>TZ</CODE> setting in props.conf or setting the TIME_FORMAT if the timezone is explicitly in the data. Splunk will always convert the timestamp internally to UTC/GMT, with the assumption that unspecified timezone data has the timezone of the indexer, and the display will always be formatted to the timezone of the search head.</P> Fri, 31 Dec 2010 02:50:27 GMT gkanapathy 2010-12-31T02:50:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-SplunkWeb-not-follow-local-timezone/m-p/19335#M2731 <P>In Splunk web, I found the timestamp column in the result list has been adjusted by local time difference. </P> <P>How can I force it to stick with log event time?</P> Thu, 30 Dec 2010 12:40:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-SplunkWeb-not-follow-local-timezone/m-p/19335#M2731 hochit 2010-12-30T12:40:01Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-SplunkWeb-not-follow-local-timezone/m-p/19336#M2732 <P>You need to make sure to specify what the timezone of the data is, using the <CODE>TZ</CODE> setting in props.conf or setting the TIME_FORMAT if the timezone is explicitly in the data. Splunk will always convert the timestamp internally to UTC/GMT, with the assumption that unspecified timezone data has the timezone of the indexer, and the display will always be formatted to the timezone of the search head.</P> Fri, 31 Dec 2010 02:50:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-SplunkWeb-not-follow-local-timezone/m-p/19336#M2732 gkanapathy 2010-12-31T02:50:27Z