topic Re: date_zone field has value 'local' & '0' in Getting Data In

date_zone field has value 'local' & '0'

splunker12er — Thu, 19 Jun 2014 11:12:00 GMT

HI,

Splunk Version : Splunk 6.1.1
Splunk Universal forwarder : version 5.0.4

I see the field 'date_zone' has values '0' & 'local'
I searched for the default timezone extraction field in props.conf, but i couldn't

How do i change this to specific time zone ? like UTC, GMT

Please advise.

Re: date_zone field has value 'local' & '0'

MuS — Thu, 19 Jun 2014 11:17:36 GMT

Hi splunker12er,

date_zone is the offset from GMT in minutes or local if you're in the same TZ. It will not show the TZ itself.
See the docs about the default fields for more information on this.

Cheers, MuS

Re: date_zone field has value 'local' & '0'

_jgpm_ — Thu, 26 Jan 2017 22:00:35 GMT

documentation has been removed. This is messing up my timecharts. Can someone recommend how to remove this?

Re: date_zone field has value 'local' & '0'

MuS — Thu, 26 Jan 2017 23:09:40 GMT

Here we go

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usedefaultfields