topic Times Unchanged For Newly Indexed Data After Time Zone Config Changes in Getting Data In

Times Unchanged For Newly Indexed Data After Time Zone Config Changes

mj9999 — Fri, 23 Aug 2013 15:45:22 GMT

I am using splunk-5.0.4-172409-x64 for Windows and can't get the time zone to offset from GMT to CDT. I have changed to central time in my user settings as well as made recommended changes to the props.conf file.

I do not expect these changes to affect old data. But newly indexed data is unaffected by the changes.

Re: Times Unchanged For Newly Indexed Data After Time Zone Config Changes

lukejadamec — Fri, 23 Aug 2013 18:15:28 GMT

What are the input types, which props.conf file did you edit, what did you put in props.conf, did you restart splunk?

Re: Times Unchanged For Newly Indexed Data After Time Zone Config Changes

mj9999 — Fri, 23 Aug 2013 18:26:13 GMT

\etc\system\local

[host::myhost]
TZ = CDT

Yes, restarted.

Re: Times Unchanged For Newly Indexed Data After Time Zone Config Changes

yannK — Mon, 28 Sep 2020 14:38:33 GMT

Is there already a timezone in the events ?
check the result with
host=myhost | convert ctime(_indextime) AS indextime | table _time indextime date_zone _raw

Re: Times Unchanged For Newly Indexed Data After Time Zone Config Changes

BenAveling — Mon, 09 Sep 2013 03:36:27 GMT

If you change the timezone for the user it should affect the display of all data, old and new. But it won't change what is stored, either for old or new data.

If you change the central timezone, or the timezone for a particular stream of log data, then that should change the timezone of any new data that is not explicitly stamped with a timezone. Events that already contain their own timezone will not be affected, nor will old events, if I understand what you are asking.