topic Re: Different timezone in Getting Data In

Different timezone

Mai_splunk — Mon, 01 Feb 2021 13:04:23 GMT

Hi all!

I have a problem with the time my logs arrive. There is an hour difference. how can I solve that? If I have data from different clients with different timezone on the same server, how can I align them?

Thanks a lot!

Re: Different timezone

richgalloway — Mon, 01 Feb 2021 14:05:40 GMT

Ideally, each event's timestamp includes a time zone indication, but it appears your event timestamps do not.

The next best option is for the UFs on each server to have a TZ setting in the local props.conf file. This time zone value is forwarded to the indexer so it can convert the timestamps properly.

Re: Different timezone

Mai_splunk — Mon, 01 Feb 2021 14:46:52 GMT

Thanks for your quickly response @richgalloway

Re: Different timezone

richgalloway — Mon, 01 Feb 2021 15:16:17 GMT

Put the appropriate time zone name on each server. Splunk knows its own time zone and will make the necessary conversions.