Searching indexes with your timezone set differently to the data's timezone

[mtmoore]

Our data's date field uses UTC for all data across the globe for this one set of data. This is fine.

When a user runs a search using earliest and latest, unless I am mistaken, the date/time field it uses will be the timestamp placed on the data by Splunk and not the date field that is in the logs.

This is all well and good if the 2 date/times match up - even then though the user can change their timezone and this goes out of whack.

How can I force the search to look at the last 7 days using the UTC date/time stamp within the log itself and not Splunk's date/time stamp?

Thanks!

[blebit]

or you can edit from your server

props.conf

[host:: the_host]
TZ = Location_TimeZone

[mtmoore]

How will this force a search to use the date time zone of the raw log as opposed to the Splunk date/time based on your personal timezone settings?

[blebit]

props.conf @ remote location

TZ=Location_TimeZone