So are IIS logs, which are by default set to GMT, read in and viewed with the web server serving up the searches timezone? Are other logs, like event logs, doing the same?
... View more
... domain (or if matching user accounts on both non-domain machines have the same password).
I wanted to add to the answer above. You can have data pulled off of a share even if one of the servers is in a domain and the other is not. I have confirmed this where my indexer is on a server in a domain but data was on a server in a work group. I have not confirmed it the other way but I believe it should work as well. Just make sure your credentials for the Splunkd service account and the user account on the share permissions are identical.
... View more