https://community.splunk.com/t5/Getting-Data-In/Searching-indexes-with-your-timezone-set-differently-to-the-data/m-p/137882#M28364 <P>props.conf @ remote location</P> <P>TZ=Location_TimeZone</P> Wed, 05 Feb 2014 14:30:07 GMT blebit 2014-02-05T14:30:07Z https://community.splunk.com/t5/Getting-Data-In/Searching-indexes-with-your-timezone-set-differently-to-the-data/m-p/137881#M28363 <P>Our data's date field uses UTC for all data across the globe for this one set of data. This is fine.</P> <P>When a user runs a search using earliest and latest, unless I am mistaken, the date/time field it uses will be the timestamp placed on the data by Splunk and not the date field that is in the logs.</P> <P>This is all well and good if the 2 date/times match up - even then though the user can change their timezone and this goes out of whack.</P> <P>How can I force the search to look at the last 7 days using the UTC date/time stamp within the log itself and not Splunk's date/time stamp?</P> <P>Thanks!</P> Wed, 05 Feb 2014 13:13:24 GMT https://community.splunk.com/t5/Getting-Data-In/Searching-indexes-with-your-timezone-set-differently-to-the-data/m-p/137881#M28363 mtmoore 2014-02-05T13:13:24Z https://community.splunk.com/t5/Getting-Data-In/Searching-indexes-with-your-timezone-set-differently-to-the-data/m-p/137882#M28364 <P>props.conf @ remote location</P> <P>TZ=Location_TimeZone</P> Wed, 05 Feb 2014 14:30:07 GMT https://community.splunk.com/t5/Getting-Data-In/Searching-indexes-with-your-timezone-set-differently-to-the-data/m-p/137882#M28364 blebit 2014-02-05T14:30:07Z https://community.splunk.com/t5/Getting-Data-In/Searching-indexes-with-your-timezone-set-differently-to-the-data/m-p/137883#M28365 <P>or you can edit from your server</P> <P>props.conf</P> <P>[host:: the_host]<BR /> TZ = Location_TimeZone</P> Mon, 28 Sep 2020 15:48:38 GMT https://community.splunk.com/t5/Getting-Data-In/Searching-indexes-with-your-timezone-set-differently-to-the-data/m-p/137883#M28365 blebit 2020-09-28T15:48:38Z https://community.splunk.com/t5/Getting-Data-In/Searching-indexes-with-your-timezone-set-differently-to-the-data/m-p/137884#M28366 <P>How will this force a search to use the date time zone of the raw log as opposed to the Splunk date/time based on your personal timezone settings?</P> Wed, 05 Feb 2014 15:17:52 GMT https://community.splunk.com/t5/Getting-Data-In/Searching-indexes-with-your-timezone-set-differently-to-the-data/m-p/137884#M28366 mtmoore 2014-02-05T15:17:52Z