The Indexers work by doing whatever you tell them to do. If you tell them nothing about timezones, then each indexer will assume that any event with a date missing a timezone is using the same timezone as that Indexer's host OS and that event will be assigned a value of local for date_zone. This is TERRIBLE rookie admin, though; I do not allow events with date_zone = local to exist on any of my Indexers. Each event should EITHER have the TZ value inside of each event's timestamp OR each host+sourcetype combination should have a TZ=foo/bar in a props.conf on every Indexer. That is the way to do it or you are going to have broken (mis-normalized) times inside of Splunk events (all over the place).
