The servers from which we are getting data is in GMT timezone. But splunk instances are on EST timezone. We are getting the timestamp from the log files itself. In search head under user-prefs.conf we made the setting tz = GMT.. Hence all time ranges in the server adds 4 hrs to iself, which includes log files also i.e. the timestamp in the log files also showing timestamp + 4 hrs in search tab under List..
We want only the time range picker in the UI to be in GMT..
If I understand you correctly, you are timestamping the events correctly. In that case, every user has his own individual TZ setting that is configurable in
Your User Name ->
Edit account ->
Time zone. This will change the way that any time is presented to you when you login EXCEPT for the time value characters inside the raw data; these are immutable and will remain what they were when indexed.
The thing that you have highlighted in red is DIRECTLY controlled by the user's
Time zone setting (exactly what I described in my answer), which also controls the meaning of the values in the
Timepicker (e.g. when exactly is "yesterday"). You NEED to be able to control this user-by-user. If you would like to see GMT for you, then change your setting to