topic Re: Change timezone on Splunk Cloud in Getting Data In

Change timezone on Splunk Cloud

will_paxata — Wed, 13 May 2015 18:06:35 GMT

My company is using Splunk Cloud and is located in the Pacific Time Zone. All of our log events include timezone offset in the format of YYYY-MM-dd HH:mm:ss.SSS 'GMT'Z.

For example, a log line could begin like so: "2015-05-13 10:44:23.956 GMT-0700". That log event is treated as UTC time (5/13/15 5:44:23.956 PM) for purposes of Splunk queries.

Is there a way to configure my Splunk account to execute queries, reports, and alerts in PST? That would actually be a big step in usability for my team.

Thanks in advance.

Re: Change timezone on Splunk Cloud

ChrisG — Wed, 13 May 2015 19:00:52 GMT

Excellent question, since in Splunk Enterprise you configure time zone settings by editing the props.conf file. You can set a user time zone using the Splunk Web UI: navigate to Settings > Users and Authentication > Access controls > Users. This will enable users to see search results in their own time zone, although it won't change the time zone of the event data.

Re: Change timezone on Splunk Cloud

will_paxata — Wed, 13 May 2015 20:19:41 GMT

Excellent! Thanks for pointing that out. If you repost as an answer instead of a comment, I can accept your answer.

Re: Change timezone on Splunk Cloud

ChrisG — Wed, 13 May 2015 20:21:33 GMT

Thanks, glad that was helpful!