- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do you set the License Usage App to use UTC time ?
Hi
I am having a lot of license overage issues so I decided to try the License Usage Dashboard APP
https://splunkbase.splunk.com/app/3178/
But the problem is that my license rolls at UTC which is currently 1900 pm CST (Central USA).
When I look at the app I don't see a way to change the time to UTC so my results are inaccurate as the next day occurs at 1900 on the current day.
Do I have to edit the queries in the dashboard panels 1x1?
If anyone has experience with this app, please advise.
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Log_wranger,
Been a long time since you asked the question, but give this a try.
Add the following file within the app. Go to $SPLUNK_HOME/etc/apps/licensequotausage/local, and create the new file props.conf. Then the 1 line to enter related to your TZ setting would be:
TZ=UTC
Then restart Splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Log_wranger,
Been a long time since you asked the question, but give this a try.
Add the following file within the app. Go to $SPLUNK_HOME/etc/apps/licensequotausage/local, and create the new file props.conf. Then the 1 line to enter related to your TZ setting would be:
TZ=UTC
Then restart Splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You'll need to set UTC at the user level. Splunk displays results to the user based on the TZ set in their user profile.
Set the time zone for a user's search results
When you add or edit users using Splunk authentication, you can set a user time zone. Search results for that user will appear in the specified time zone. This setting, however, does not change the actual event data, whose time zone is determined at index time. For information on setting this value, see Configure users with Splunk Web in the Securing Splunk manual.
See https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Applytimezoneoffsetstotimestamps for more details.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your reply.
If I change my preferences to GMT the app works fine, but then I have to switch back for the search app.
I was looking for a way to set the "app" TZ=UTC...
but I don't know how to set that up...
