https://community.splunk.com/t5/Getting-Data-In/Timestamps-and-timezones/m-p/104995#M22108 <P>You should probably set the TIME_* properties in props.conf for your respective sources/sourcetypes/hosts. Depending on your architecture (Heavy Forwarder/Indexer only), you might have to set this in different places; </P> <PRE><CODE>TIME_PREFIX = TIME_FORMAT = MAX_TIMESTAMP_LOOKAHEAD = TZ = </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf</A><BR /> <A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings">http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/ApplyTimezoneOffsetstotimestamps">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/ApplyTimezoneOffsetstotimestamps</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Configuretimestamprecognition">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Configuretimestamprecognition</A></P> <P>Hope this helps,</P> <P>Kristian</P> Wed, 24 Apr 2013 10:49:04 GMT kristian_kolb 2013-04-24T10:49:04Z https://community.splunk.com/t5/Getting-Data-In/Timestamps-and-timezones/m-p/104994#M22107 <P>My Splunk install is indexing logs that contain both a UTC timestamp and a timezone. Logs are being generated by devices spread across a range of timezones. </P> <P>At the moment just the UTC timestamp is used and the timezone is currently ignored which is fine if I want to analyze logs based on the absolute time they occurred. But I'd also like to be able to analyze events based on the local time of day they were generated (i.e. the time of day as seen by the device that generated the logs). </P> <P>I can obviously do that by manually calculating the "local time at which the event occured" at search time by performing a lookup of timezone to timezone offset and adding this to the timestamp. Is there any easier / more efficient way to do it though?</P> Wed, 24 Apr 2013 07:17:54 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamps-and-timezones/m-p/104994#M22107 MatMeredith 2013-04-24T07:17:54Z https://community.splunk.com/t5/Getting-Data-In/Timestamps-and-timezones/m-p/104995#M22108 <P>You should probably set the TIME_* properties in props.conf for your respective sources/sourcetypes/hosts. Depending on your architecture (Heavy Forwarder/Indexer only), you might have to set this in different places; </P> <PRE><CODE>TIME_PREFIX = TIME_FORMAT = MAX_TIMESTAMP_LOOKAHEAD = TZ = </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf</A><BR /> <A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings">http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/ApplyTimezoneOffsetstotimestamps">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/ApplyTimezoneOffsetstotimestamps</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Configuretimestamprecognition">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Configuretimestamprecognition</A></P> <P>Hope this helps,</P> <P>Kristian</P> Wed, 24 Apr 2013 10:49:04 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamps-and-timezones/m-p/104995#M22108 kristian_kolb 2013-04-24T10:49:04Z