https://community.splunk.com/t5/Getting-Data-In/Timezones-Timestamps-on-data/m-p/95915#M19966 <P>You can't change already indexed data in Splunk. You could mask the events with | delete to prevent them from showing up in future searches, then re-index the bad data with the TZ settings in place. </P> Wed, 11 Jul 2012 19:49:09 GMT jbsplunk 2012-07-11T19:49:09Z https://community.splunk.com/t5/Getting-Data-In/Timezones-Timestamps-on-data/m-p/95914#M19965 <P>We changed the TZ field from Asia/Shanghai to UTC.</P> <P>The data that was indexed prior to the change has the "bad" splunk dates on it. Do we need to re-index or something? How can we reset those timestamps?</P> Wed, 11 Jul 2012 18:18:46 GMT https://community.splunk.com/t5/Getting-Data-In/Timezones-Timestamps-on-data/m-p/95914#M19965 rachelneal 2012-07-11T18:18:46Z https://community.splunk.com/t5/Getting-Data-In/Timezones-Timestamps-on-data/m-p/95915#M19966 <P>You can't change already indexed data in Splunk. You could mask the events with | delete to prevent them from showing up in future searches, then re-index the bad data with the TZ settings in place. </P> Wed, 11 Jul 2012 19:49:09 GMT https://community.splunk.com/t5/Getting-Data-In/Timezones-Timestamps-on-data/m-p/95915#M19966 jbsplunk 2012-07-11T19:49:09Z