Getting Data In

Timezone and Timestamp modification at search/report time?

paymon
Engager

We have standardized our infrastructure on UTC, but we want to generate reports in PST. Is there a way to specify a timezone transform at search time such that the events themselves don’t need to be modified? the link below would change the actual messages as they come in and I want to keep the data in splunk and my various raw syslog messages consistent.

http://www.splunk.com/base/Documentation/4.1.3/Admin/Applytimezoneoffsetstotimestamps

Tags (2)

landen99
Motivator

The answer is as wrong now as it was 9 years ago. Epoch time exists independent of time zones, but your answer alters epoch time without consideration for what epoch time is. No sense continuing the nine years of confusion simply because no one noticed the mistake before.

0 Karma

rgustafson
Explorer

Could you handle daylight savings time dynamically?

0 Karma

bschandramohan
Engager

Am i missing something? PST = -7:00 of GMT, so this should be 7*60*60 = 25200. Why is it 28800?

0 Karma

daviduslan
Path Finder

Pacific Time (PT) is -7 OR -8 of GMT depending on Daylight Saving Time. From winter to spring it's -8 (PST), from spring to winter it's -7 (PDT).

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!