topic Re: Splunk date/time localization problem in Splunk Search

Splunk date/time localization problem

marotit — Mon, 14 Nov 2011 12:21:26 GMT

Hi,

i'm facing the problem that I cannot set the time and date in Splunk in the way that it displays it in the hungarian format. The desciption of "http://localhost:8000/hu_HU/" doesn't help either. At the same time as I would have seen a hu_HU directory somewhere in the localization files.

The manuals on internet also couldn't really help how to set these formats manually.

Best regards,

Thomas Maroti

Re: Splunk date/time localization problem

Takajian — Mon, 14 Nov 2011 12:51:12 GMT

If you want to display your localized character, you can refer to following site.

http://splunk-base.splunk.com/answers/26283/chinese-characters-in-splunk-web

However, I think splunk does not support hungarian character yet. You can ask splunk support team.
As for date/time, splunk extract system time from your splunk server.

Re: Splunk date/time localization problem

kristian_kolb — Mon, 14 Nov 2011 13:05:06 GMT

I think it is rather a question of in which order days/months/years/minutes/hours etc should be presented. Sorry for not being able to help, though.

Re: Splunk date/time localization problem

Ayn — Mon, 14 Nov 2011 13:12:48 GMT

For some discussion on this issue, have a look at the following question and its answers: http://splunk-base.splunk.com/answers/525/how-can-i-change-the-time-format-in-splunk-web

One workaround that is not discussed there but works perfectly well is to copy a working locale in $SPLUNK_HOME/lib/python2.6/site-packages/splunk/appserver/mrsparkle/locale to your own locale. In my case I needed the date format used in Sweden, which happens to be identical to what is used in the UK, so I simply copied $SPLUNK_HOME/lib/python2.6/site-packages/splunk/appserver/mrsparkle/locale/en_GB to $SPLUNK_HOME/lib/python2.6/site-packages/splunk/appserver/mrsparkle/locale/sv_SE. If I'm not mistaken Hungary uses the same time format as well, so in your case just copy the en_GB dir to hu_HU instead. Restart Splunk for the changes to take effect.