topic Timezone Configurations in Getting Data In

Timezone Configurations

agodoy — Thu, 02 Jan 2014 15:33:48 GMT

I have events that are sent in UTC. I have specified in props.conf TZ=UTC for the source. However, when I search for the events they are still being displayed in UTC in the future. I would like to see them in local time. I was reading some of the other questions and it looks like I need to define the local timezone for my Splunk servers.

What is the right way to do this in a Splunk cluster? Do the configs need to be placed in the search peers, search head, all members of the cluster? Would the configs for the local time zone go under the [default] stanza in props.conf?

Thanks

Re: Timezone Configurations

Adrian — Mon, 28 Sep 2020 15:33:58 GMT

Edit the props.conf file in $SPLUNK_HOME/etc/system/local/ or in your own custom application directory in $SPLUNK_HOME/etc/apps/.

The documentation you require is here:
http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Applytimezoneoffsetstotimestamps

There is also a similar question posed with answer here as well:

http://answers.splunk.com/answers/110403/incorrect-event-time-in-splunk

Re: Timezone Configurations

agodoy — Thu, 02 Jan 2014 17:26:51 GMT

I guess the TZ=UTC does not work under the source or sourcetype stanza? It did work under the host stanza.