Getting Data In

Custom time not working maybe locale issue

New Member

I set the custom time to June 14 11:48:00 -> June 14 11:48:05. I then click on search and the log info is shown but the search on the screen states "198 events from 11:48:00 AM to 11:48:05 AM on Sunday, June 13, 2010". I assume I need to set some sort of locale ? I am in New Zealand.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

This sounds like a bug to me.

0 Karma

Path Finder

Depending on the source of your data you need to set TZ appropriately, both on the input (props.conf), and in your environment ("export TZ=My/TimeZone")

Splunk will then search correctly with your given offsets, unless something extra-special is happening.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...