topic Re: Moving Servers Timezone Issues in Getting Data In

Moving Servers Timezone Issues

andrewkenth — Wed, 02 Apr 2014 18:46:39 GMT

We are moving our Splunk server (everything is on this one server) however the old and new servers are in different timezones so all of my date before the move is now one hour earlier then it should be.

How can I stop this from happening? We have many dated only (no time) events and it is changing the day these events took place.

Thanks!

Re: Moving Servers Timezone Issues

yannK — Wed, 02 Apr 2014 20:41:28 GMT

when the events are indexed, if there are no TZ specified, the events are considered as in the timezone of the indexer . Please check this http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/ApplyTimezoneOffsetsToTimeStamps
Events indexed in splunk are converted to epoch time, so once indexed the indexer can be moved to another timezone.
at search time, the timezone is specified by the search-head or the user profile. Verify your profiles.

Re: Moving Servers Timezone Issues

andrewkenth — Wed, 02 Apr 2014 20:52:03 GMT

How can I move the data in my pre move to a different time zone?

I am indexing w/o any time zone specification.

Re: Moving Servers Timezone Issues

andrewkenth — Wed, 02 Apr 2014 20:52:31 GMT

How can I move the data in my pre move to a different time zone?

I am indexing w/o any time zone specification.

Re: Moving Servers Timezone Issues

yannK — Wed, 02 Apr 2014 21:06:59 GMT

I am indexing w/o any time zone specification.

then this is the issue, splunk default to the indexer timezone, that may not the same than your data, use the previous documentation link and enforce a timezone.

Re: Moving Servers Timezone Issues

andrewkenth — Thu, 03 Apr 2014 14:05:35 GMT

That is what I was thinking but how do I enforce a time zone on data that has already been imported?

Re: Moving Servers Timezone Issues

yannK — Mon, 28 Sep 2020 16:18:46 GMT

There is no way to do that, the data indexed is "carved in stone".
You are better deleting and reindexing if you have the original data.
see http://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder

The only hack to display results correctly at search time, could be to search over larger timerange, then change the _time field selectively.
Example to add one hour to all your events :
<mysearch> <mylargertimerange> | eval _time=_time+60*60 | search <myfinaltimerange>