How to configure Splunk to recognize data is from a specific timezone?

[brutecat]

Hi there,

I need some help regarding time zone (I think). I have data that was collected in Europe (CET time). My analysis system where I load the data into Splunk is in the Australian time zone (AEST). I seem to have misalignment between what I know happened on specific days and the dates/times displayed in Splunk. I believe it's due to Splunk interpreting the data to be in my time zone.

Is there somewhere in the configuration where I can tell Splunk that the data is from a specific time zone (apart from re-timestamping the data)?

Thanks,

Stan

[stephanefotso]

Hello!
You can set your events timestamp via splunk Web http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Modifyeventprocessing when indexing data, or by editing your props.conf http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Applytimezoneoffsetstotimestamps

Thanks.