Adding Melbourne and Sydney Australia as available time zones in GUI.

[Lucas_K]

I'd previously raised this years ago as a support ticket but it hasn't been added so I thought i'd post it here as it is an on going issue and it causes no end to the absolute hell that it has caused.

There is no Melbourne or Sydney Australia time zone in the gui for users to set their correct time zones. This still exists in the latest v6.5.

As our search heads support users from all over the world setting it as a default isn't appropriate.

Supports original suggestion of telling users to use Hobart, does functionally work but is very unprofessional to be telling high level managers that they are in a different part of the country 😉 Like telling a New Yorker they are from Florida I suppose.

The fix is so very, very simple. Yet has missed 2 large version releases (v5 and v6).

./etc/apps/search/default/data/ui/manager/authentication_change_user_password.xml

Find Line 109
109 <opt value="Australia/Hobart" label="(GMT+10:00) Hobart"/> 

Add 
110 <opt value="Australia/Melbourne" label="(GMT+10:00) Melbourne"/> 
111 <opt value="Australia/Sydney" label="(GMT+10:00) Sydney"/>

After

[eavent_splunk · Accepted solution]

Happy to say that with the release of 7.1, Sydney and Melbourne are both available as Time Zone selections in the web interface.

[Lucas_K]

oh thank god! 😄

[jplumsdaine22]

Finally we can stop being lorded over by Tasmanians

[abrown_splunk]

Hi Lucas - just want to make sure I understand what you're up against here. Is it that Melbourne and Sydney are in a different timezone and function incorrectly or is it that by omitting these (admittedly major) cities from the options list, people have to select a different city that is in the same timezone but not representative of their geographic location?

FWIW, I'm in Seattle and and for many years I had to choose "PST - Cupertino, CA" - I just see it as some human-readable language to validate you're picking the right time zone instead of an indication of your exact location.

[Lucas_K]

I understand it isn't supposed to be an exact location but from a users perspective there isn't THAT many large cities in Australia to compare it to the US (we literally have 7 major ones total.)

I would have thought splunk would have used the standard TZ list.

https://en.wikipedia.org/wiki/List_of_tz_database_time_zones

Most users and Australians in general are on our eastern side of the country. Melbourne, Sydney, Brisbane (12 million) vs Hobart (200k).

As such as have people that not know if Hobart has the same Daylight savings as all those 3 (hint, they don't), so it isn't clear to people that they are selecting the right thing, or not but choosing Hobart. Which is more of a big town than a city 😉

Remember, Splunk is a time series index so time is VERY important, almost the most important thing. Set in events and also via the UI. Getting it wrong changes the perspective of how the data is presented.

We've had numerous people keep asking. Should I be selecting Hobart? Where is Melbourne or Sydney? Its been an ongoing joke that it hasn't been updated in the past 5 years. It is very embarrassing when we have to tell managers this software we're paying $10's of millions for each year for can't have an official timezone included in it.

If it is deemed officially as too hard and the solution is "just use hobart" then that is fine. I'll just customize every search head to include the code fix myself.

[abrown_splunk]

Thanks for the explanation as well as your workaround. I'll see if I can get more feedback from the folks in the know.

[MuS]

Just my 2cents here:

the fix must not be applied in $SPLUNK_HOME/etc/apps/search/default/data/ui/manager/authentication_change_user_password.xml, this can potentially break at each upgrade. Put it in $SPLUNK_HOME/etc/apps/search/local/data/ui/manager/authentication_change_user_password.xml instead.

cheers, MuS

[mrgibbon]

Still the same in v7.0.0

[Lucas_K]

😞 yeah didn't really expect it to be added officially.

[Lucas_K]

As of v6.5 this issue still persists.

sigh

[Lucas_K]

v6.5.2. the saga continues. Seriously splunk devs I've posted the code!

[jplumsdaine22]

I agree that this should be fixed

But... "absolute hell". Really?

At least Melbourne got kicked off the list as well. I can't imagine how unbearable Sydney people would be if Melbourne was on the list but not Sydney 🙂 Someone tell 702!

[Lucas_K]

We had exec level management make business decisions based on incorrect time information due to this. As their login was gmt timezoned the presentation of dashboards was out by 10 hours.

It wasn't until engineering came back and said "it's impossible for those figures to be that at those times" that the logged in users profile was checked.

So yes, "absolute hell" was accurate and highly embarrassing when we were directly competing with other big data systems at the same time to produce the reports. It's hard to be an avangelist for a product when the simplest of fixes never make it into the product. I have a dozen other similar reported fixes.