we have hosts sending logs to indexer using universal forwarders. The hosts are spread across different time zones.
i want to know how the indexer Synchronize different time zones into one. Can you refer any document or something?
The Indexers work by doing whatever you tell them to do. If you tell them nothing about timezones, then each indexer will assume that any event with a date missing a timezone is using the same timezone as that Indexer's host OS and that event will be assigned a value of
date_zone. This is TERRIBLE rookie admin, though; I do not allow events with
local to exist on any of my Indexers. Each event should EITHER have the TZ value inside of each event's timestamp OR each host+sourcetype combination should have a
TZ=foo/bar in a
props.conf on every Indexer. That is the way to do it or you are going to have broken (mis-normalized) times inside of Splunk events (all over the place).
Have you already seen the foillowing answer?
Every way the documentation is at https://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Applytimezoneoffsetstotimestamps