https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50451#M9622 <P>Looks to be working now</P> Tue, 04 Sep 2012 16:15:40 GMT Ant1D 2012-09-04T16:15:40Z https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50446#M9617 <P>Hi,</P> <P>I have some data in an index where the events all begin with a UTC timestamp. My Splunk indexer server is in the UK and I would like the timestamps for these events to be interpreted as being in the Splunk indexer timezone (UK) instead of the UTC.</P> <P>How can I do this?</P> <P>At present, if a new event arrives at 11AM UK time, the timestamp will say 10AM which is the UTC time so it means that any searches that I do over the last 60 minutes or less will return no results which should not be the case.</P> <P>Thanks in advance for your help.</P> Tue, 04 Sep 2012 11:27:32 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50446#M9617 Ant1D 2012-09-04T11:27:32Z https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50447#M9618 <P>Hi Ant1D</P> <P>have you check the <A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/ApplyTimezoneOffsetstotimestamps">docs</A> on how to set different timezones?</P> <P>cheers,</P> <P>MuS</P> Tue, 04 Sep 2012 12:37:17 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50447#M9618 MuS 2012-09-04T12:37:17Z https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50448#M9619 <P>Here is the link for TZ settings in the Splunk Docs</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/ApplyTimezoneOffsetstotimestamps">http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/ApplyTimezoneOffsetstotimestamps</A></P> Tue, 04 Sep 2012 14:50:08 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50448#M9619 whitewool 2012-09-04T14:50:08Z https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50449#M9620 <P>I tried using the TZ = value attribute before and it didn't work. I guess I can try this again</P> Tue, 04 Sep 2012 15:06:50 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50449#M9620 Ant1D 2012-09-04T15:06:50Z https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50450#M9621 <P>I tried using the TZ = value attribute before and it didn't work. I guess I can try this again</P> Tue, 04 Sep 2012 15:06:59 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50450#M9621 Ant1D 2012-09-04T15:06:59Z https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50451#M9622 <P>Looks to be working now</P> Tue, 04 Sep 2012 16:15:40 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50451#M9622 Ant1D 2012-09-04T16:15:40Z https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50452#M9623 <P>The solution is to make the following addition to your props.conf file:</P> <P><CODE>[the_sourcetype_name]<BR /> TZ = the_timezone_that_your_timestamps_are_in</CODE></P> <P>For this question, you would need to add <CODE>TZ = UTC</CODE></P> Tue, 04 Sep 2012 16:18:53 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50452#M9623 Ant1D 2012-09-04T16:18:53Z https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50453#M9624 <P>thanks for the link</P> Tue, 04 Sep 2012 16:20:07 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50453#M9624 Ant1D 2012-09-04T16:20:07Z https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50454#M9625 <P>thanks for the link</P> Tue, 04 Sep 2012 16:20:14 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-displaying-events-with-the-correct-timezone/m-p/50454#M9625 Ant1D 2012-09-04T16:20:14Z