Splunk Search

Global Summary date format ignores locale


Splunk 4.1.5 build 85165 Win32

I have used the tips/hacks listed in this forum to copy en_GB to en_AU.

The Search Summary page here; http://:8000/en-AU/app/search/dashboard still shows the 'Earliest event' and 'Latest event' dates as MM/DD/YYYY.

It appears to be displayed correctly in the actual search screens. Can these dates follow the locale as well?

Tags (2)
0 Karma

Re: Global Summary date format ignores locale

Splunk Employee
Splunk Employee


This only changes the dates in the results sets. If you are looking at the Summary pages when you first log in they are hardcoded with the US format. You will need to change the XML to show the non-US format.

on whatever page you are on append ?showsource=1

You will see at the bottom in the XML window that there are lines like: …………fieldformat "Last Update"=strftime('Last Update', "%m/%d/%Y %T")

Modify them to say "%d/%m/%Y %T" and you should be good.

You can change the search/XML in the Manager--> User interface --> Views to the format you want.

0 Karma