When I'm looking at an event, there is a TIME field to the left column and then the actual event has it's own time listed as well.
Is the TIME column using the clock from my PC and the Time within the event is the time reported by the log source?
Time field is being adjusted to match your
Time zone setting in your user's
Preferences. Keep in mind that the
timestamp of the event is not always based on the string that is in
_raw. Some people are lazy and use inadvisable settings like
DATETIME_CONFIG = current.
You'd need to log onto the server to see that. OR if your Timezone is set to "Default System Timezone", then you can find your timezone (which is same as system timezone in this case), by running a search like this
| makeresults | eval timezone=strftime(_time,"%Z (%z)")
The time within the event is the raw data from the source. The value in the TIME column (which I assume is _time renamed) is Splunk's interpretation of when the event happened. It should be the same as one of the time strings in the event. It will be displayed in the time zone you selected in your Splunk preferences.