In your app (I'll use the default search app as the example though) you edit the event_renderers.conf file. For the default search app this would be under Splunk/etc/users/%user% (for example admin)/search/local. In this file you will find an example like below. [eventtype_name_stanza] css_class = et_red eventtype = eventtype_name priority = 6 The colour is being set by "css_class = et_red" from the file application.css which for the default search app would be under Splunk/etc/apps/search/appserver/static. You can even play with this real time in Firefox or Chrome by editing the html on the search results page. By default it will be like so (standard white no eventtype colours). <td class="expands " tabindex="0"><a><i class="icon-triangle-right-small"></i></a></td> If you edit the html to be purple you will see it change. <td class="expands et_purple" tabindex="0"><a><i class="icon-triangle-right-small"></i></a></td> ... View more

Neither of these quite worked for me but put me on the right track. I ended up doing what gkanapathy had without the bucket. index="security" user="123456" EventCode=4634 OR EventCode=4624) | eval Date=strftime(_time, "%d/%m/%Y") | stats earliest(_time) AS Earliest, latest(_time) AS Latest by Date | eval Logon=strftime(Earliest,"%+") | eval Logoff=strftime(Latest,"%+") | table Date, Logon, Logoff ... View more

How do I mark your comment as an answer? ... View more

Well it seems to be working at the moment. I added: [host::PERTH*] TZ = Australia/Perth So the server is this time zone is now reporting the right times. But...another server in another TZ which is still on the default stanza in props.conf is not having any issues either. So I can't tell if it was just a case of the forwarder and/or indexer playing catch up or if the setting fixed it. ... View more

How to install heavy forwarder, if you have any thing regarding installation could you please provide them. Thanks in advance ... View more