Why are "AWS billing detailed events" displayed in the future (on the next month) like "AWS support developer" events? What are the parameters that will solve the problem? UTC GMT props.conf? Thank you for your help.
Yes, you have a timestamping problem:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Applytimezoneoffsetstotimestamps
You will need to make changes in props.conf to teach Splunk which hosts/sources are using which TZ, then update your indexers and restart them.
props.conf
