Getting Data In

Convert to PST Time

lain179
Communicator

Hello:

My system log files are in GMT, as well as the Splunk forwarder and Splunk server. They are all in GMT (or UTC)

However, my Splunk users are in PST time zone. So, I would like the splunk searches, reports and alerts to display the charts and tables in PST time. How can I accomplish that?

Thank you!

Tags (2)
0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

You can edit the time zone TZ attribute in props.conf. See Specify time zones of timestamps in the Getting Data In manual.

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

You can edit the time zone TZ attribute in props.conf. See Specify time zones of timestamps in the Getting Data In manual.

ChrisG
Splunk Employee
Splunk Employee

I see...I don't think there is any way to do a multiple user update like this within Splunk. You would have to write a script to update the tz setting in each user file, which is in $SPLUNK_HOME/etc/users//user-prefs/local/user-prefs.conf.

0 Karma

lain179
Communicator

We have hundreds of users imported from LDAP. Is there any way to make a mass tiemzone edit for all users? They are all set to "Default System TimeZone" --- may be I can change the default to PST? How do I do that? Thank you!

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Ah, sorry, I misunderstood. You can set each user's time zone in Manager, so they can see events in their own time zone. Manager > Access controls > Users.

0 Karma

lain179
Communicator

Yes, I did this and nothing changes.
[host::hostname]
TZ = Etc./UTC

My problem is not that logs are in different timezone than the Splunk server. My logs and Splunk server are in the same time zone. But my Splunk users are in PST.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...