topic Re: Adjusting data in GMT time zone so that splunk recognizes it in Getting Data In

Adjusting data in GMT time zone so that splunk recognizes it

OMohi — Thu, 13 Aug 2015 17:12:50 GMT

Is there a way to tell Splunk what time zone the data is in so it a query run for ET automatically grabs the records with the correct adjustment for GMT? For example, if we ask for data from midnight to midnight, Splunk would automatically know to add 4 hours to adjust the time from GMT to ET.

I have recognized a way on how to address the time zone disparity by editing the props as follows. But not sure whether this will work or not. The servers are sending data in GMT time zone whereas Splunk instances are on EST time zone.

[sourcetype]
TZ = GMT

Please let me know.

Re: Adjusting data in GMT time zone so that splunk recognizes it

somesoni2 — Thu, 13 Aug 2015 17:44:08 GMT

If you've setup the props.conf as mentioned in the question on Indexer/Heavy Forwarder, Splunk should attach proper/adjusted _time value to events. The timerange of the search should take the adjusted _time value and display result. Did you try to search data and what was it doing?

Re: Adjusting data in GMT time zone so that splunk recognizes it

woodcock — Thu, 13 Aug 2015 19:40:05 GMT

You have done half the job in aligning your data so Splunk knows your events' TZ but you also have to tell it your TZ by setting it in Your Name -> Settings -> Time zone.