Does Splunk take into consideration Timezone Daylight Saving ?

[DavidHourani]

Hello Splunkies and Splunklemen ,

Does Splunk Automatically take into consideration Daylight Savings Time (DST) ? Or should this parameter be defined somewhere ?

If so can anyone tell me how its done via props.conf ?

Thanks !

[woodcock · Accepted solution]

IMHO, unless each event specifies TZ inside the event timestamp, you should always set TZ by host in props.conf like this:

# Tuscon
[host::My\.Host\.IP\.Here]
TZ = US/Mountain

[darlas]

I think I spoke too soon! Looks like _time is now reflecting daylight savings time. Thanks so much!

[darlas]

In my situation, I have defined TZ=PST in my props.conf file for the particular event source. My Splunk servers are all in UTC. This worked fine until recently when we moved the clocks up an hour for daylight savings time. So now it seems my TZ should = PDT, but there is not such a value. Also this means I would have to change this 2x/year when we change the clocks..and in each props.conf file. Am I missing something here? How do I handle this situation?

Thanks!!!

[woodcock]

The "US/" notation implies DST, which is one of the reasons I used it in my answer. You need "US/Pacific" to handle DST changes.

[darlas]

Thanks for the quick reply! I changed my props.conf but does not seem to be changing the behavior. I've given it about 30 minutes just in case it took time to affect the events. I'll have to keep digging.

[DavidHourani]

Cool! Thank you. This goes on the indexer right ? Would it modify _time for all the logs or only the recently added ones ?

[woodcock]

Only new ones that come in after the indexer has Splunk restarted. You can track which events have updated TZs and which do not by looking at the date_zone field. Don't forget to "Accept" my answer!

[DavidHourani]

Thanks mate!