Hello,
I have following issue:
- I am located with most of my users in CET zone. For 2 years until last week all looked fine in respect to the timezone of the users. I know this option is not there, but the system, although itself having the UTC, behaved as if it would recognize the users location and presenting the CET in the searches.
- Like week back, i have no clue why, the system decided to present the GMT timezone to the users in searches. Well, when I go to the user properties it will be the "Default System Timezone" there, so one could say it behaves as expected.
My questions would be:
- is there any possibility that Splunk detects the time zone of the user based e.g. on the browser settings?
- If not, how would I mass change it for my users to CET? Clicking through the user settings one by one is not much fun
- Theoretically I could make a change for all users:
etc/system/local/user-prefs.conf
[default]
# Only canonical timezone names such as America/Los_Angeles are allowed
tz = America/Los_Angeles
The question is what the correct canonical timezone name for CET would be?
tz = Europe/Berlin ?
Kind Regards,
Kamil
Hi,
You can try to configure $SPLUNK_HOME/etc/apps/user-prefs/local/user-prefs.conf
with below configuration (I have not tested this but it should work)
[general]
tz = <timezone>
* Specifies the per-user timezone to use
* If unset, the timezone of the Splunk Server or Search Head is used.
* Only canonical timezone names such as America/Los_Angeles should be
used (for best results use the Splunk UI).
* Defaults to unset.
OR
[general_default]
tz = <timezone>
As CET timezone is for Europe, you can check list of all available timezone in Europe on https://en.wikipedia.org/wiki/List_of_tz_database_time_zones and accordingly set tz
in user-prefs.conf