Splunk App for AWS: Why are "AWS billing detailed events" displayed in the future and what props.conf parameters will solve the problem?

[damdr]

Why are "AWS billing detailed events" displayed in the future (on the next month) like "AWS support developer" events? What are the parameters that will solve the problem? UTC GMT props.conf? Thank you for your help.

[woodcock]

Yes, you have a timestamping problem:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Applytimezoneoffsetstotimestamps

You will need to make changes in props.conf to teach Splunk which hosts/sources are using which TZ, then update your indexers and restart them.