I am using Splunk Light for Windows, and I have imported some IIS Logs files, but the timezone is out by an hour.
I have been using the following as a workaround:
What is the correct way to permanently adjust the timezone?
I haven't used Splunk Light yet, but I assume the configs are the same. In your props.conf specification for the IIS sourcetype, set the Timezone explicitly. IIS knows nothing other than the GMT timestamp. So all events from IIS are in GMT.
TZ = GMT