topic Re: Where to set timezone override? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Where-to-set-timezone-override/m-p/67080#M13465 <P>There is a great article on the Splunk wiki: <A href="http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F">Where do I configure my Splunk settings</A><BR /> The timezone setting goes in props.conf. It <STRONG>MUST</STRONG> be set where the data is parsed, so that means the heavy forwarders AND the indexers. See this <A href="http://splunk-base.splunk.com/answers/11768/timezone-offset">answer</A> from S Sorkin; all Sorkin answers are definitive.</P> Sat, 03 Sep 2011 17:56:45 GMT lguinn2 2011-09-03T17:56:45Z Where to set timezone override? https://community.splunk.com/t5/Getting-Data-In/Where-to-set-timezone-override/m-p/67078#M13463 <P>We have an environment with a mix of light/heavy forwarders, a deployment server, an indexer, and multiple apps. If I want to set the timezone for a group of servers which props.conf (or other) do I set the TZ = X in? The indexer global, indexer app, deployment server, or forwarder itself?</P> Tue, 30 Aug 2011 17:47:10 GMT https://community.splunk.com/t5/Getting-Data-In/Where-to-set-timezone-override/m-p/67078#M13463 sseekamp 2011-08-30T17:47:10Z Re: Where to set timezone override? https://community.splunk.com/t5/Getting-Data-In/Where-to-set-timezone-override/m-p/67079#M13464 <P>Hi sseekamp</P> <P>I would do this on the indexer to keep it simple, but as always there are many ways leading to Rome.</P> <P>cheers</P> Tue, 30 Aug 2011 18:50:20 GMT https://community.splunk.com/t5/Getting-Data-In/Where-to-set-timezone-override/m-p/67079#M13464 MuS 2011-08-30T18:50:20Z Re: Where to set timezone override? https://community.splunk.com/t5/Getting-Data-In/Where-to-set-timezone-override/m-p/67080#M13465 <P>There is a great article on the Splunk wiki: <A href="http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F">Where do I configure my Splunk settings</A><BR /> The timezone setting goes in props.conf. It <STRONG>MUST</STRONG> be set where the data is parsed, so that means the heavy forwarders AND the indexers. See this <A href="http://splunk-base.splunk.com/answers/11768/timezone-offset">answer</A> from S Sorkin; all Sorkin answers are definitive.</P> Sat, 03 Sep 2011 17:56:45 GMT https://community.splunk.com/t5/Getting-Data-In/Where-to-set-timezone-override/m-p/67080#M13465 lguinn2 2011-09-03T17:56:45Z