topic Re: how to change the upload time stamp? in Getting Data In

how to change the upload time stamp?

Abilan1 — Fri, 27 Nov 2015 12:18:59 GMT

Hi ,

Actually I am having splunk index servers in Eastern Time Zone (UTC-5:00) but some of my application servers are in Hong Kong Time Zone (UTC+ 08:00). so now if I see the data in splunk it's all are in Eastern Time zone. I wanted to change the time stamp to Hong Kong Time zone only for these servers.

Re: how to change the upload time stamp?

richgalloway — Fri, 27 Nov 2015 13:25:46 GMT

No data can be changed once it's been indexed, including timestamps. Having all events in a common time zone makes it far easier to correlate them without any confusing mental math. One could probably come up with a sequence of eval statements to convert Hong Kong times back to that time zone, but that might be confusing and would not work for users in other time zones.

Re: how to change the upload time stamp?

woodcock — Sun, 29 Nov 2015 02:24:19 GMT

To change this you can add several host= stanzas inside props.conf with TZ=Hongkong for those particular servers and either deploy them to the Forwarders or the Indexers and restart the Splunk instances there. This will effect only events indexed after the restart. You can purge the wrong events from the Indexers, clean the fishbucket on the Forwarders and then they will resend the events.