Change default web UI locale?

[gljiva]

Hi, I have seen several questions regarding change of the default en_US locale but none of the solutions work for my case.
I have tried to copy the en_GB locale content and overwrite en_US files /opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/locale/en_US/ but Splunk still shows old en_US timeformat. When i explicitly visit splunk:8000/en-GB/ then all timestamps are in desired format but visiting splunk:8000/en-US/ after overwriting its content it still shows old behavior (even after restart).
The solution I found that works is editing /opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/i18n.py and replacing en-US with en-GB. This way even visiting splunk:8000/en-US/ I will get en-GB timestamps.
Latter approach is not good because upgrading Splunk will overwrite changes, and also changing Splunk code is not desired.
Changing all client browsers to return en-GB for locale is also not an option. Is there a way to achieve desired behavior by defining default locale timeformat in configuration files or some other configuration setup?

Thanks.

[bjarnedein]

This was how to change the timestamp, what about number formats?
How and where do you change the thousand separator from comma to dot, and vise versa the decimal separator from dot to comma.

See - that would change my (and a whole lot others) world to a new dimension!

[Lucas_K]

6 years on and there is no update to having this as a standard feature or supported config option.

Latest versions also break the previous work arounds above.

Anyone have this working correctly in 6.6.3+?

[BorisGrochalski]

See https://answers.splunk.com/answers/463655/change-default-language.html for a workaround of hardcoding your locale in Splunk 7.x and 8.x
Also consider voting for this idea/change request to get this conf option finally implemented into the product:
Per user UI language and date/time settings

[tweaktubbie]

I wonder if anyone has a workaround (that works after upgrades) or info from Splunk on how this is fixed or not?

A workaround that partly worked for me was editing ../etc/system/local/web.conf and under [settings] add
tools.proxy.base = https:// (full URL}:{portnumber}/en-GB/

Side effect was that clicking the top left Splunk> logo lead to {full URL}:{portnumber}/en-GB//en-GB/ (double slash indeed)
Editing files like this sounds a bit open source; should be some default in the web.conf you can add.
I do not want to force all users into en-GB; if they want to use en-US by specifying it in the URL that's fine. The problem is my browser(s) Chrome and IE11 make splunk believe it's en-US.

Still I wonder why setting your Time Zone in the UI /manager/nn/authentication/users does not affect your default locale settings.

[gljiva · Accepted solution]

Here is a response from Splunk team:

First create a new application within your splunk instance:

pwd /splunkhome/etc/apps

Make new app directory by:

mkdir time mkdir time/appserver mkdir time/appserver/modules/

pwd /splunkhome/etc/apps/time/appserver/modules/results

Copy this file into the directory:

cp /splunkhome/share/splunk/search_mrsparkle/modules/results/EventsViewer_ def ault_renderer.html .

Then edit EventsViewer_default_renderer.html

Starting on line 72 there is an if statement. Modify line 73 so that the whole if statement looks like this:

    % if i18n.current_lang_url_component()=="en-US":
        ${(event.time.strftime('%d/%m/%Y

%H:%M:%S'))} % else: ${i18n.format_datetime_microseconds(event.time)} % endif

Restart splunk via ./splunk restart

This way, when you upgrade the time format will not be changed back. The only drawback to this is that when upgrading if there are huge changes in the original EventsViewer_default_renderer.html file you might need to perform this change once again.

[nlapier2]

I've been trying to use this fix in version 6.1.1 and it's not working. I followed the instructions exactly and even changed the default one as well. Does anyone have any idea how to make this work in splunk 6.1.1?

[ssbarnea]

This seems like a bad joke workaround for a missing essential feature. The should should default to ISO-8601 by default anyway, without having to patch it to have standard date-time values.

[w531t4]

if anyone is wondering - this still works in 5.0.4. We used the following string.

${(event.time.strftime('%Y-%m-%d %H:%M:%S.%f')[:-3]).replace(' ', '
', 1).replace(' ', ' ')}

[Ayn]

As far as I know the way you did with editing i18n.py is the only way to go for now. I filed a bug about this a few months ago, hopefully the default locale will be configurable in a future release.

[rroberts]

I have found en_GB, en_US, it_IT, ja_JP, ko_KR , zh_CH and zh_TW OOTB in Splunk's locale folder. Anyone have a Spanish or Portuguese package?

[dlisicre]

RRoberts, did you find Spanish package?

[ftk]

Have you tried accessing splunk via http://splunk:8000/en-GB/ instead of en-US?

[gljiva]

Yes, and that works as mentioned. Problem is I wan't to allow users to use GB type of timestampes even if they use US locale. That's why I tried replacing en_US with en_GB without success.