From the little documentation I can find, it seems that Splunk Search head Web UI will attempt to use the locale configure in your browser.
I am in an european country which language is not supported in Splunk so the UI keeps defaulting to en_US.
How do I tell Splunk to default to en_GB (Or one of the other support Splunk languages) so we get more sensible timestamps in the UI?
I am looking for a "proper" solution (A simple configuration somewhere) and NOT having to manually change the URL address in the browser nor have to hack python files which may break on upgrades.
According to the documentation:
It is browser specified, which makes it difficult for you, since that would break other things for you. And since the override method of changing the URL is not what you are looking for, you may be out of luck for a simple solution.
Have thought about using a "vanity URL" that redirects from a simple URL to the one that you want? It should do what you want in all other aspects. So you set up
splunk.mybiz.se to point to
splunk.mybiz.se:8000/en_GB. We use nginx to redirect our Splunk access through to the 8000 port, and I don't see any reason that you could not do the same thing in this case.
If we had an nginx sure however we go directly to the search head as we only have one. Thanks for the answer, it sounds strange that there is no way to change this as clearly my browser is not reporting en-US
You should be able to run nginx on the same server and have it only answer on port 80, which Splunk doesn't normally answer on anyway. If you ever have more than one SH, it would come in handy for load balancing anyway.
Please check below splunk answer it might help you,
go to this location,
1) make sure enGB is present.
2) tar enUS
3) Delete en_US
Deletion of the enUS dir breaks the splunk ui. There must be some other dependency that the UI requires from the enUS directory.
"Error connecting: Connection refused"