topic TZ Issues When Searching in Getting Data In

TZ Issues When Searching

wbkendall — Mon, 19 May 2014 17:42:42 GMT

Hello,

We're currently doing a pilot of Splunk. We have two servers - one is an indexer and the other a search head. We have a Linux syslog server that collects all firewall logs and forwards these to the indexer via the Universal Forwarder agent.

All firewalls are set to UTC. This causes an issue when searching for events, as we're in US Eastern time. The only way to get the relevant events to show up in searches is to effectively search in the future relative to our local time (ie compute UTC for the time desired, and search on those values).

I've checked and both the server and the dashboard are set to the correct time zone.

Is there a way to display the time locally in the dashboard while leaving it unmodified within the index?

Thanks!

Re: TZ Issues When Searching

somesoni2 — Mon, 19 May 2014 17:48:34 GMT

You may try setting the timezone of the users to UTC, so that when they search, time range will correspond to UTC.

Re: TZ Issues When Searching

lukejadamec — Mon, 19 May 2014 17:53:37 GMT

Check out this information on how Splunk determines the TZ.

http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/ApplyTimezoneOffsetstotimestamps

Re: TZ Issues When Searching

wbkendall — Mon, 19 May 2014 18:54:23 GMT

Thanks everyone. I finally just ended up modifying the props.conf in /opt/splunkforwarder/etc/apps/Splunk_TA-cisco-asa/local/ with this value:

[host:::*]
TZ = US/Eastern

Thanks!