topic Re: Change all user timezone in Dashboards & Visualizations

Change all user timezone

BrianLam — Tue, 17 Jun 2025 21:25:42 GMT

Hi,

I would like to ask to how change all user timezone to Pacific time. I did some research and see people recommend to config this file - SPLUNK_HOME/etc/apps/user-prefs/local/user-prefs.conf. But from what I know, or at learst how my Splunk was set up. It's a Saas, they provided me a link to my domain and I start using it. I'm not quite sure where exactly is the mentioned file.

Thanks,

Brian

Re: Change all user timezone

isoutamo — Tue, 17 Jun 2025 21:58:42 GMT

What you are meaning with “change tz for all users”? If they are sitting in PT time zone and they are using “use system TZ settings” then it is already in PT time zone if their workstations/ laptops are correctly configured.

If you want to change that also for people which are not sitting in PT zone, then I ask why?

In internally splunk is storing all times as UTC. Then it shows times by users time zone or what they have set in their account preferences.

Re: Change all user timezone

BrianLam — Tue, 17 Jun 2025 22:09:43 GMT

I created roles using SAML config then assign the role to user when they are created. I looked into all users and they don't have a default time zone set to their account. Yes they can set it through preference and I also can manually change it in Setting for all of the users but it's tedious to do one by one. I want to config it so that all the old and future users would have PT time zone automatically.

Re: Change all user timezone

isoutamo — Tue, 17 Jun 2025 22:44:01 GMT

If they haven’t set any time zone then it’s their workstation’s time zone. Is this tz wrong or what is the issue? I’m afraid that you are trying to solve an issue which doesn’t exists!

Re: Change all user timezone

BrianLam — Tue, 17 Jun 2025 22:46:55 GMT

yes, the time zone is wrong, I check with a user, they're located in PT time zone but their default time zone is UTC.

Re: Change all user timezone

isoutamo — Tue, 17 Jun 2025 22:50:00 GMT

The Splunk’s TZ has set to UTC on browser and workstation has correct PT TZ? What SSO/idp you are using?

Re: Change all user timezone

PickleRick — Wed, 18 Jun 2025 09:46:48 GMT

What do you mean by "Saas" here? It's either a Splunk Enterprise instance (either administered by you or a third party) or a Splunk Cloud service subscription.

Re: Change all user timezone

eddieddieddie — Wed, 13 May 2026 23:53:33 GMT

I also get this same problem with our new Splunk Cloud instance. All users default to what looks like UTC timezone, in the preferences for each user the time zone shows as "-- Default System Timezone --" (or if I look at the user, as an admin from the 'users' screen it shows as unset). This impacts both locally created user accounts and for accounts from SAML authentication.

Is there a way to set a default timezone for at least new SAML users? As all users will be in New Zealand so having a default the timezone as UTC is just confusing.

Re: Change all user timezone

bowesmana — Thu, 14 May 2026 05:35:08 GMT

I don't believe you can set the default for SAML users. I went through this recently with a bunch of South Australian users and it caused no end of problems for the non technical users as time by default was UTC.

It ended up being an education / onboarding to Splunk process for those users.