I tested my on-premiss splunk with single instance (SH+IDX).

[odorusatoshi]

It was cleared the issue when I set different OS time zone and splunk user timezone.
But my splunk cloud instance was not able to clear this issue.
As you may know, splunk cloud has 1-SH and 3-IDX, even though newest TA was installed into IDXs.

I assumed that splunk cloud is also different time zone setting both SH and IDXs.
What is the root cause?

Originally posted by @odorusatoshi in #225 (comment)