Currently Splunk's Docker container does not support TZ or TIMEZONE options. I am able to change the TZ for a individual user but this still causes discrepancies in some log files and times. Additionally for free users who are unable to set a TZ for users this means they are stuck on UTC.
You'll have to rebuild the Docker image using updated TZ in the Docker Makefile.
Hi, have you tried modifying the Dockerfile and set the timezone there?
Yeah I attempted TIMEZONE = America/Vancouver and when I enter "date" in the console it would respond with the UTC time but specify the timezone I selected.
Here's how i did it in my dockerfile and it seems to be working:
ARG SPLUNK_VERSION
FROM splunk/splunk:${SPLUNK_VERSION}
ENV TZ=America/Toronto
USER root
RUN set -eux chown -R splunk:splunk /opt/splunk/etc/; \
chmod -R 755 /opt/splunk/etc/; \
ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone;
USER ansible