Why are the time stamps on email alerts incorrect in the web GUI?

[GaryChan1]

Hi,

When I do a search in the web GUI, the time stamps on the results are correct. If I save that search as and set up an email alert for it, the time stamps in the table on the email are incorrect. They are offset by 10.5 hours, which is the same as my timezone (+10.5).

I've asked this question on a different forum and one suggestion was to check to timezone settings for the user that owns the searches (in the web GUI). I have checked this and can confirm that it is correct.

Is there somewhere else I should be looking?

Thanks,

[valiquet]

Maybe time parsing is not set in props.conf
Can you share it?

[GaryChan1]

Is that located in $SPLUNK_HOME/etc/system/local/ normally? If so, I don't have one.

[p_gurav]

Can you check in application's directory you running search?

[GaryChan1]

This is the props.conf for the Splunk_TA_windows app:

https://pastebin.com/9m0rnE8U

I just realised I made an absolute mess of the title on this post. For clarification, timezone in web GUI is correct. The same search configured as an alert that is sent via email has the timezone offset.