Moving Servers Timezone Issues

[andrewkenth]

We are moving our Splunk server (everything is on this one server) however the old and new servers are in different timezones so all of my date before the move is now one hour earlier then it should be.

How can I stop this from happening? We have many dated only (no time) events and it is changing the day these events took place.

Thanks!

[andrewkenth]

How can I move the data in my pre move to a different time zone?

I am indexing w/o any time zone specification.

[yannK]

• when the events are indexed, if there are no TZ specified, the events are considered as in the timezone of the indexer . Please check this http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/ApplyTimezoneOffsetsToTimeStamps
• Events indexed in splunk are converted to epoch time, so once indexed the indexer can be moved to another timezone.
• at search time, the timezone is specified by the search-head or the user profile. Verify your profiles.

[yannK]

There is no way to do that, the data indexed is "carved in stone".
You are better deleting and reindexing if you have the original data.
see http://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder

The only hack to display results correctly at search time, could be to search over larger timerange, then change the _time field selectively.
Example to add one hour to all your events :
<mysearch> <mylargertimerange> | eval _time=_time+60*60 | search <myfinaltimerange>

[andrewkenth]

That is what I was thinking but how do I enforce a time zone on data that has already been imported?

[yannK]

I am indexing w/o any time zone specification.

then this is the issue, splunk default to the indexer timezone, that may not the same than your data, use the previous documentation link and enforce a timezone.

[andrewkenth]

How can I move the data in my pre move to a different time zone?

I am indexing w/o any time zone specification.