What makes difference timezone on same sourcetype by two Heavy Forwarder

[michael_wong]

Deleted

[richgalloway · Accepted solution]

That the two HFs use the same indexer and SH has no bearing on this problem.  The HFs are parsing the logs independently.

Please share sample events for the zscalerapi-zia-audit sourcetype from each HF.

Are the props.conf settings installed on both HFs?

[michael_wong]

I want to make your post as a solution, but seems click the wrong button.

Sorry for that.

[richgalloway]

I changed it.

[michael_wong]

Very helpful. The problem was I put the props.conf  in indexer instead of HF. After move the conf to HF, the issue was solved. 

Thank you for your help.