https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-recognize-data-is-from-a-specific/m-p/133419#M27430 <P>Hi there,</P> <P>I need some help regarding time zone (I think). I have data that was collected in Europe (CET time). My analysis system where I load the data into Splunk is in the Australian time zone (AEST). I seem to have misalignment between what I know happened on specific days and the dates/times displayed in Splunk. I believe it's due to Splunk interpreting the data to be in my time zone.</P> <P>Is there somewhere in the configuration where I can tell Splunk that the data is from a specific time zone (apart from re-timestamping the data)?</P> <P>Thanks,</P> <P>Stan</P> Tue, 02 Jun 2015 06:57:40 GMT brutecat 2015-06-02T06:57:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-recognize-data-is-from-a-specific/m-p/133419#M27430 <P>Hi there,</P> <P>I need some help regarding time zone (I think). I have data that was collected in Europe (CET time). My analysis system where I load the data into Splunk is in the Australian time zone (AEST). I seem to have misalignment between what I know happened on specific days and the dates/times displayed in Splunk. I believe it's due to Splunk interpreting the data to be in my time zone.</P> <P>Is there somewhere in the configuration where I can tell Splunk that the data is from a specific time zone (apart from re-timestamping the data)?</P> <P>Thanks,</P> <P>Stan</P> Tue, 02 Jun 2015 06:57:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-recognize-data-is-from-a-specific/m-p/133419#M27430 brutecat 2015-06-02T06:57:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-recognize-data-is-from-a-specific/m-p/133420#M27431 <P>Hello!<BR /> You can set your events timestamp via splunk Web <CODE><A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Modifyeventprocessing" target="test_blank">http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Modifyeventprocessing</A></CODE> when indexing data, or by editing your props.conf <CODE><A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Applytimezoneoffsetstotimestamps" target="test_blank">http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Applytimezoneoffsetstotimestamps</A></CODE></P> <P>Thanks.</P> Tue, 02 Jun 2015 08:22:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-recognize-data-is-from-a-specific/m-p/133420#M27431 stephanefotso 2015-06-02T08:22:04Z