How to set SplunkWeb not follow local timezone?

[hochit]

In Splunk web, I found the timestamp column in the result list has been adjusted by local time difference.

How can I force it to stick with log event time?

[gkanapathy · Accepted solution]

You need to make sure to specify what the timezone of the data is, using the TZ setting in props.conf or setting the TIME_FORMAT if the timezone is explicitly in the data. Splunk will always convert the timestamp internally to UTC/GMT, with the assumption that unspecified timezone data has the timezone of the indexer, and the display will always be formatted to the timezone of the search head.