topic Re: Does Splunk take into consideration Timezone Daylight Saving ? in Getting Data In

Does Splunk take into consideration Timezone Daylight Saving ?

DavidHourani — Wed, 03 Jun 2015 12:59:15 GMT

Hello Splunkies and Splunklemen ,

Does Splunk Automatically take into consideration Daylight Savings Time (DST) ? Or should this parameter be defined somewhere ?

If so can anyone tell me how its done via props.conf ?

Thanks !

Re: Does Splunk take into consideration Timezone Daylight Saving ?

woodcock — Wed, 03 Jun 2015 13:44:52 GMT

IMHO, unless each event specifies TZ inside the event timestamp, you should always set TZ by host in props.conf like this:

# Tuscon
[host::My\.Host\.IP\.Here]
TZ = US/Mountain

Re: Does Splunk take into consideration Timezone Daylight Saving ?

DavidHourani — Thu, 04 Jun 2015 08:55:51 GMT

Cool! Thank you. This goes on the indexer right ? Would it modify _time for all the logs or only the recently added ones ?

Re: Does Splunk take into consideration Timezone Daylight Saving ?

woodcock — Thu, 04 Jun 2015 13:06:53 GMT

Only new ones that come in after the indexer has Splunk restarted. You can track which events have updated TZs and which do not by looking at the date_zone field. Don't forget to "Accept" my answer!

Re: Does Splunk take into consideration Timezone Daylight Saving ?

DavidHourani — Thu, 04 Jun 2015 13:11:39 GMT

Thanks mate!

Re: Does Splunk take into consideration Timezone Daylight Saving ?

darlas — Mon, 29 Jun 2015 19:32:34 GMT

In my situation, I have defined TZ=PST in my props.conf file for the particular event source. My Splunk servers are all in UTC. This worked fine until recently when we moved the clocks up an hour for daylight savings time. So now it seems my TZ should = PDT, but there is not such a value. Also this means I would have to change this 2x/year when we change the clocks..and in each props.conf file. Am I missing something here? How do I handle this situation?

Thanks!!!

Re: Does Splunk take into consideration Timezone Daylight Saving ?

woodcock — Mon, 29 Jun 2015 19:35:28 GMT

The "US/" notation implies DST, which is one of the reasons I used it in my answer. You need "US/Pacific" to handle DST changes.

Re: Does Splunk take into consideration Timezone Daylight Saving ?

darlas — Mon, 29 Jun 2015 20:32:17 GMT

Thanks for the quick reply! I changed my props.conf but does not seem to be changing the behavior. I've given it about 30 minutes just in case it took time to affect the events. I'll have to keep digging.

Re: Does Splunk take into consideration Timezone Daylight Saving ?

darlas — Mon, 29 Jun 2015 20:58:50 GMT

I think I spoke too soon! Looks like _time is now reflecting daylight savings time. Thanks so much!