How to permanently adjust the timezone for IIS logs in Splunk Light on Windows?

[johnc_ncc]

Hi,

I am using Splunk Light for Windows, and I have imported some IIS Logs files, but the timezone is out by an hour.
I have been using the following as a workaround:

eval _time=_time-3600

What is the correct way to permanently adjust the timezone?

Thanks

[alacercogitatus]

I haven't used Splunk Light yet, but I assume the configs are the same. In your props.conf specification for the IIS sourcetype, set the Timezone explicitly. IIS knows nothing other than the GMT timestamp. So all events from IIS are in GMT.

[iis]
TZ = GMT