Well, for the timezone issues, you can always go to settings -> sourcetypes, find your sourcetype, click on edit and under advanced tab put the following. This will get pushed to your indexers and you would be good in that regard. TZ = <Your preferred timezone> Mountain time (MST) is 7 hours behind UTC. And you confirmed that the timezone set in your user' preferred timezone in Splunkcloud is also MST. The timestamp that eventually will show up as _time for you will always be MST. So for the log sources coming via servers in UTC, you'll always see _time being 7 hours behind the time you see in the event. That's not going away. If you want to see _time match with the time present in the events coming from servers in UTC, you need to change your preferred timezone to UTC. Splunk respects the time present in the events, so you'll always see the differences for obvious reasons. What you can also do is create a props.conf and deploy it to all your servers with your preferred TZ. That will be get applied as metadata and when the data eventually reaches the indexers, you'll always see the _time as your preferred timezone. For the events coming from UTC, you'll see them 7 hours ahead in the events, but _time will always be MST. And as always, the last pass to resolve all of this is to either sync all servers with NTP or set them into the same timezones, which obviously may not be feasible but just putting it out there.
... View more