When you tell Splunk how to timestamp an event ant tell it what Timezone to use with the TZ parameter in props.conf, this does only apply to the field that you specify that Splunk use for timestamping, which you can see as field _time. However, the data in the event itself is absolutely not modified in any way and you have to do this yourself using the strftime and strptime and relative_time functions to normalize it to your needs (you can create a macro for this to make it semi-automatic and less of a hassle). You could also convert the data in your DB (I know). You could also convert each datetime in the SQL query itself to force it to come into Splunk pre-normalized to whatever TZ you like; this is documented here:
http://stackoverflow.com/questions/19613638/sql-server-convert-datetime-into-another-timezone
Lastly, you need to tell your Splunk web session what timezone you are in, too! Go to `` -> Edit account -> Time zone and set it correctly for your timezone.
