Hi,
I have some data in an index where the events all begin with a UTC timestamp. My Splunk indexer server is in the UK and I would like the timestamps for these events to be interpreted as being in the Splunk indexer timezone (UK) instead of the UTC.
How can I do this?
At present, if a new event arrives at 11AM UK time, the timestamp will say 10AM which is the UTC time so it means that any searches that I do over the last 60 minutes or less will return no results which should not be the case.
Thanks in advance for your help.
The solution is to make the following addition to your props.conf file:
[the_sourcetype_name]
TZ = the_timezone_that_your_timestamps_are_in
For this question, you would need to add TZ = UTC
The solution is to make the following addition to your props.conf file:
[the_sourcetype_name]
TZ = the_timezone_that_your_timestamps_are_in
For this question, you would need to add TZ = UTC
Here is the link for TZ settings in the Splunk Docs
http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/ApplyTimezoneOffsetstotimestamps
thanks for the link
I tried using the TZ = value attribute before and it didn't work. I guess I can try this again
thanks for the link
Looks to be working now
I tried using the TZ = value attribute before and it didn't work. I guess I can try this again