Splunk Search

Dockerized Splunk Time Zone Forced to UTC

raidercom
Communicator

I'm having an issue with dockerized splunk post 8.1.3 free. The timezone in the web interface remains as UTC. With 8.1.3, I could get around the timezone issue by running:
docker exec -ti splunk sudo microdnf -y --nodocs update tzdata on startup of the container
Post 8.1.3, the time within the container remains as UTC, even with tzdata installed. Is this expected behaviour?


Sample from the docker compose that brings up splunk:
Docker compose:
splunk:
container_name: splunk
image: splunk/splunk:latest
#image: splunk/splunk:8.1.3
environment:
- TZ=America/Toronto
#- TZ=Canada/Eastern

With 8.1.3
Pulling splunk (splunk/splunk:8.1.3)...
8.1.3: Pulling from splunk/splunk
Digest: sha256:fd7dfb17323ee093ca36b71befa71e5074f8a6dc592475407927a0d443022a03
Status: Downloaded newer image for splunk/splunk:8.1.3

date
Wed Jun 2 17:19:41 EDT 2021


With Latest:
latest: Pulling from splunk/splunk

date
Wed Jun 2 21:36:34 America 2021

Does anyone have any suggestions of things I could try?
Thanks
-Jeff

1 Solution

raidercom
Communicator

Figured out the issue.

Was able to fix it with:

docker exec -ti splunk sudo microdnf -y --nodocs reinstall tzdata

rather than the original:

docker exec -ti splunk sudo microdnf -y --nodocs update tzdata

 

Not sure why the docker image acts differently, especially since the Linux version used is the same between 8.1.3 and >8.1.3

View solution in original post

0 Karma

raidercom
Communicator

Figured out the issue.

Was able to fix it with:

docker exec -ti splunk sudo microdnf -y --nodocs reinstall tzdata

rather than the original:

docker exec -ti splunk sudo microdnf -y --nodocs update tzdata

 

Not sure why the docker image acts differently, especially since the Linux version used is the same between 8.1.3 and >8.1.3

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

How to Monitor AI Agents with Splunk Agent Observability

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...