TZ Issues When Searching

[wbkendall]

Hello,

We're currently doing a pilot of Splunk. We have two servers - one is an indexer and the other a search head. We have a Linux syslog server that collects all firewall logs and forwards these to the indexer via the Universal Forwarder agent.

All firewalls are set to UTC. This causes an issue when searching for events, as we're in US Eastern time. The only way to get the relevant events to show up in searches is to effectively search in the future relative to our local time (ie compute UTC for the time desired, and search on those values).

I've checked and both the server and the dashboard are set to the correct time zone.

Is there a way to display the time locally in the dashboard while leaving it unmodified within the index?

Thanks!

[wbkendall]

Thanks everyone. I finally just ended up modifying the props.conf in /opt/splunkforwarder/etc/apps/Splunk_TA-cisco-asa/local/ with this value:

[host:::*]
TZ = US/Eastern

Thanks!

[lukejadamec]

Check out this information on how Splunk determines the TZ.

http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/ApplyTimezoneOffsetstotimestamps

[somesoni2]

You may try setting the timezone of the users to UTC, so that when they search, time range will correspond to UTC.