I am thinking about building an environment in a country where daylight saving time exists, but as for the server, I am setting to change the summer time and winter time automatically,
Will it automatically change with respect to the time zone set for the user of splunk?
If it does not change automatically, what should be set?
https://answers.splunk.com/answers/241990/does-splunk-take-into-consideration-timezone-dayli.html
as answered by Woodcock, unless each event specifies TZ inside the event timestamp, you should always set TZ by host in props.conf like this:
# Tuscon
[host::My\.Host\.IP\.Here]
TZ = US/Mountain