Getting Data In

How to configure Splunk to recognize data is from a specific timezone?

Path Finder

Hi there,

I need some help regarding time zone (I think). I have data that was collected in Europe (CET time). My analysis system where I load the data into Splunk is in the Australian time zone (AEST). I seem to have misalignment between what I know happened on specific days and the dates/times displayed in Splunk. I believe it's due to Splunk interpreting the data to be in my time zone.

Is there somewhere in the configuration where I can tell Splunk that the data is from a specific time zone (apart from re-timestamping the data)?



Tags (2)
0 Karma


You can set your events timestamp via splunk Web when indexing data, or by editing your props.conf