Checkpoint logs being indexed incorrectly ( One hour earlier )

[LeandroKopke]

I am having trouble with my checkpoint log.
Or indefinite is late hour.

Example:
Actual time of the event: 12:15.
Time that is indexed on spunk: 11:15: AM

Time at checkpoint is correct. Splunk time is ticking. Already added in props.conf the checkpoing or sourcetype [opsec] and put the parameter
TZ = America / Sao_Paulo, but I have the wrong indexing

[jacobpevans]

The past weekend was daylight savings changeover. Are you certain all your timezones are set properly? Is the clock on the indexer(s) accurate?

[LeandroKopke]

Hi Jacob.
Yes. I'm check all indexers.

[somesoni2]

Where have you put the props.conf for TZ setting for opsec sourcetype, Indexer/Intermediate Forwarder OR at universal forwarder where you're monitoring the log file?

[LeandroKopke]

A TZ configuration was used in the indexer. This server has the OPSEC LEA app and all configuration is all made on it.