Getting Data In

Timezones Timestamps on data

Path Finder

We changed the TZ field from Asia/Shanghai to UTC.

The data that was indexed prior to the change has the "bad" splunk dates on it. Do we need to re-index or something? How can we reset those timestamps?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

You can't change already indexed data in Splunk. You could mask the events with | delete to prevent them from showing up in future searches, then re-index the bad data with the TZ settings in place.

Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...