All Apps and Add-ons

How to change time zone on data collection node to eastern from pacific time

mtime24
Path Finder

Hello,

I'm trying to deploy the latest VMware App and i'm seeing that my ubuntu linux search head was the correct time but my data collection node deployed from the ova does not. There is a three hour difference between the two so i'm assuming that the DCN ova is set to pacific time while i'm in boston which is eastern time. How does one go about making this change?

Also, i've seen references on ubuntu and centos forums that one must run sudo dpkg-reconfigure tzdata but that command is not recognizable by the DCN? any suggestions?alt text

0 Karma
1 Solution

woodcock
Esteemed Legend

On Ubuntu, the timezone is controlled by this file:

/etc/timezone

Check it like this:

cat /etc/timezone
US/Pacific

Just change this to:

US/Eastern

View solution in original post

0 Karma

mtime24
Path Finder

in order to change the time zone on the data collection node which is running CentOS 6.4 one most run the following command:

sudo tzselect and follow the prompts

0 Karma

woodcock
Esteemed Legend

Click Accept on your answer.

0 Karma

woodcock
Esteemed Legend

I appreciate you accepting mine but yours is the correct answer so you should accept it (this one)!

0 Karma

petercow
Path Finder

I presume you don't want to change the timezone on your server, but rather, for Splunk to recognize that the data is coming from a server in a different timezone.

On the indexer(s), in props.conf

[host::myBostonServer]
TZ = US/Eastern

0 Karma

mtime24
Path Finder

I'm in the middle of troubleshooting why the VMware App won't work and one of the steps is to check time on all the servers involved. currently the Data Collection Node time is off by three hours so i need to change it to eastern time and i'm hoping that that will make the VMware App work. the Search head is also a linux box so i'm not sure where the props.conf file would live but the search head time is correct is not the DCN which is not.

0 Karma

mtime24
Path Finder

we encountered a power outage and the time change did not stick and running through the above steps didn't fix correct the time (not sure why). I had to do the following in order to fix

sudo rm /etc/localtime
sudo ln -s /usr/share/zoneinfo/America/New_York /etc/localtime
Wait a minute for my clock to get updated

0 Karma

woodcock
Esteemed Legend

On Ubuntu, the timezone is controlled by this file:

/etc/timezone

Check it like this:

cat /etc/timezone
US/Pacific

Just change this to:

US/Eastern
0 Karma

mtime24
Path Finder

i cannot find the /etc/timezone entry anywhere? I will post a few screenshots in a second, would you be able to tell me the actual path?

0 Karma

mtime24
Path Finder

just want to add that my search head is running ubuntu but the time is correct on my search head the problem is with the DCN or Data Collection node.

0 Karma

woodcock
Esteemed Legend

What OS/distribution is your DCN? The instructions that I gave are for Ubuntu. Try this:

uname -a
0 Karma

mtime24
Path Finder

the DCN is running CentOS 6.4

i had to cat centos-release in root/etc/

0 Karma

mtime24
Path Finder

looks like in CentOS there is a file called localtime in root/etc....somehow i need to edit that

0 Karma

mtime24
Path Finder

running sudo tzselect on the DCN allows me to change the time

0 Karma

woodcock
Esteemed Legend

For CentOS, the same instructions should apply except it is this file:

/etc/localtime
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...