I have added TZ=GMT to the props.conf under [iis] and restarted splunk. The Server is CST.
From what I have read the new indexed data will reference the new time. How do you reference the existing index data to the new time. I am having to adjust searches with "latest=+360m" to get current results.