The problem has been resolved with the following stanza in /opt/splunk/etc/system/local/props.conf [audit:log] TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%dT%H:%M:%S%:z MAX_TIMESTAMP_LOOKAHEAD = 30 SHOULD_LINEMERGE = false # TZ = UTC MAX_DIFF_SECS_HENCE = 86400 DATETIME_CONFIG = CURRENT Some additional research. Prior to adding the bottom two lines to the stanza, I verified the VM is aware of the correct date and time, that it was distinguishing between local and UTC properly (note that the change from EDT to EST moved the offset from 4 to 5 hours), and that we were sync'd to NTP. splunk@idx1:~$ date Tue Nov 4 11:32:35 AM EST 2025 splunk@idx1:~$ timedatectl Local time: Tue 2025-11-04 11:32:47 EST Universal time: Tue 2025-11-04 16:32:47 UTC RTC time: Tue 2025-11-04 16:32:47 Time zone: America/New_York (EST, -0500) System clock synchronized: yes NTP service: active RTC in local TZ: no splunk@idx1:~$ timedatectl show | grep NTPSynchronized NTPSynchronized=yes Then verified that there was nothing abnormal on the search heads which could be taking priority of the changes made to the indexer. splunk@srch01:~$ /opt/splunk/bin/splunk btool props list audit:log --debug splunk@srch01:~$ splunk@srch02:~$ /opt/splunk/bin/splunk btool props list audit:log --debug splunk@srch03:~@ splunk@srch03:~$ /opt/splunk/bin/splunk btool props list audit:log --debug splunk@srch03:~$ ... View more

I believe I have the stanza in the correct location, here's a btool output and the sourcetype in question is only in one of two places. splunk@splk-indexer01:~$ /opt/splunk/bin/splunk btool props list audit:log --debug /opt/splunk/etc/system/local/props.conf [audit:log] /opt/splunk/etc/system/default/props.conf ADD_EXTRA_TIME_FIELDS = True /opt/splunk/etc/system/default/props.conf ANNOTATE_PUNCT = True /opt/splunk/etc/system/default/props.conf AUTO_KV_JSON = true /opt/splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE = /opt/splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE_DATE = True /opt/splunk/etc/system/default/props.conf CHARSET = UTF-8 /opt/splunk/etc/system/default/props.conf DATETIME_CONFIG = /etc/datetime.xml /opt/splunk/etc/system/default/props.conf DEPTH_LIMIT = 1000 /opt/splunk/etc/system/default/props.conf DETERMINE_TIMESTAMP_DATE_WITH_SYSTEM_TIME = false /opt/splunk/etc/system/default/props.conf HEADER_MODE = /opt/splunk/etc/system/default/props.conf LB_CHUNK_BREAKER_TRUNCATE = 2000000 /opt/splunk/etc/system/default/props.conf LEARN_MODEL = true /opt/splunk/etc/system/default/props.conf LEARN_SOURCETYPE = true /opt/splunk/etc/system/default/props.conf LINE_BREAKER_LOOKBEHIND = 100 /opt/splunk/etc/system/default/props.conf MATCH_LIMIT = 100000 /opt/splunk/etc/system/default/props.conf MAX_DAYS_AGO = 2000 /opt/splunk/etc/system/default/props.conf MAX_DAYS_HENCE = 2 /opt/splunk/etc/system/default/props.conf MAX_DIFF_SECS_AGO = 3600 /opt/splunk/etc/system/default/props.conf MAX_DIFF_SECS_HENCE = 604800 /opt/splunk/etc/system/default/props.conf MAX_EVENTS = 256 /opt/splunk/etc/system/default/props.conf MAX_EXPECTED_EVENT_LINES = 7 /opt/splunk/etc/system/local/props.conf MAX_TIMESTAMP_LOOKAHEAD = 30 /opt/splunk/etc/system/default/props.conf MUST_BREAK_AFTER = /opt/splunk/etc/system/default/props.conf MUST_NOT_BREAK_AFTER = /opt/splunk/etc/system/default/props.conf MUST_NOT_BREAK_BEFORE = /opt/splunk/etc/system/default/props.conf SEGMENTATION = indexing /opt/splunk/etc/system/default/props.conf SEGMENTATION-all = full /opt/splunk/etc/system/default/props.conf SEGMENTATION-inner = inner /opt/splunk/etc/system/default/props.conf SEGMENTATION-outer = outer /opt/splunk/etc/system/default/props.conf SEGMENTATION-raw = none /opt/splunk/etc/system/default/props.conf SEGMENTATION-standard = standard /opt/splunk/etc/system/default/props.conf SHOULD_LINEMERGE = True /opt/splunk/etc/system/local/props.conf TIME_FORMAT = %Y-%m-%dT%H:%M:%S%:z /opt/splunk/etc/system/local/props.conf TIME_PREFIX = ^ /opt/splunk/etc/system/default/props.conf TRANSFORMS = /opt/splunk/etc/system/local/props.conf TRUNCATE = 75000 /opt/splunk/etc/system/default/props.conf detect_trailing_nulls = false /opt/splunk/etc/system/default/props.conf maxDist = 100 /opt/splunk/etc/system/default/props.conf priority = /opt/splunk/etc/system/default/props.conf sourcetype = /opt/splunk/etc/system/default/props.conf termFrequencyWeightedDist = false /opt/splunk/etc/system/default/props.conf unarchive_cmd_start_mode = shell   ... View more

The indexer is not recognizing the then 4 hour offset from UTC; I say then because we flipped form EDT to EST over the weekend. So, when an event is received by the indexer at 08:00:00 EDT, the 12:00:00UTC time is being recognized and Splunk holds that event until noon EDT. ... View more

Hello, It is a straight-forward solution. I have a UF that is reading an internal file and forwarding contents to the Indexer. The Indexer is receiving those updates in UTC minus US eastern time offset (now 5 hours) but is not adjusting as per changes made to the Indexer's props.conf. All suggestions were tried and restarts took place after each change. No change in status... ... View more

Struck out here as well. ... View more

Hello, I've tried the suggested TIME-FORMAT with and without TZ = UTC and it's still reading 4 hours into the future. ... View more

Hello, I'm working on the indexer's props.conf. I've tried it with and without TZ = UTC and it's still reading 4 hours into the future. ... View more

There is an automation that is supposed to only grab CSV files and move them into another directory. Looks like it needs to be tweaked because it is also grabbing text files. Appreciate the help. ... View more

This was it. Thank you for the assist. ... View more

Making this adjustment was just what I needed. I noticed that as I started playing with fields I could change the results, but I was focusing on the secondary query as opposed to the base query. Thank you all for the help and advice. ... View more

Hello, That's actually where I started this. I took a functioning panel with the full query and then ripped out the primary section for the base search. I also tried creating a new dashboard from scratch and get the same empty results. The only thing I can do to so something displays is to comment out all of   <query> | stats count as "Object Deletions" BY UserId | search "Object Deletions" &gt; 50 | sort - "Object Deletions" </query> If I leave any part of that code in, it fails. ... View more