Updating the system time on my indexers - how will this affect my indexes/searches etc?

[mctester]

We would like to change all of our system times on our 9 indexers to UTC to help standardize the log times between our security tools.

Will this affect the logs and saved alerts that we have set up. Will we have to modify the time the saved searches run to reflect the new UTC times?

[Mick · Accepted solution]

Changing the system time on your servers shouldn't affect your scheduled searches or your data in any way. As long as you are extracting the timestamp from the events, and indexing them according to that time, Splunk should continue to work as normal and use those timestamps in the index.

Likewise, assuming that your are one of the standard scheduling methods for your scheduled searches - every hour, every 4 hours, etc - or a simple cron schedule, then they should also continue to work as normal.

The only concerns I would have, is if you have any timezone offsets applied to your data, or if you were using the current system time as your event timestamp - then you may see some adverse effects after you make your update. In fact, you may have to apply some timezone offsets to your data so that the events and timelines are displayed correctly in the UI