I'm trying to deploy the latest VMware App and i'm seeing that my ubuntu linux search head was the correct time but my data collection node deployed from the ova does not. There is a three hour difference between the two so i'm assuming that the DCN ova is set to pacific time while i'm in boston which is eastern time. How does one go about making this change?
Also, i've seen references on ubuntu and centos forums that one must run sudo dpkg-reconfigure tzdata but that command is not recognizable by the DCN? any suggestions?
I presume you don't want to change the timezone on your server, but rather, for Splunk to recognize that the data is coming from a server in a different timezone.
On the indexer(s), in props.conf
TZ = US/Eastern
I'm in the middle of troubleshooting why the VMware App won't work and one of the steps is to check time on all the servers involved. currently the Data Collection Node time is off by three hours so i need to change it to eastern time and i'm hoping that that will make the VMware App work. the Search head is also a linux box so i'm not sure where the props.conf file would live but the search head time is correct is not the DCN which is not.
we encountered a power outage and the time change did not stick and running through the above steps didn't fix correct the time (not sure why). I had to do the following in order to fix
sudo rm /etc/localtime
sudo ln -s /usr/share/zoneinfo/America/New_York /etc/localtime
Wait a minute for my clock to get updated