Our server's configured timezone offset (TZ) has been changed from Eastern to UTC. Do we need to take any steps?

[Ellen]

Is there a way to update the timestamp of the legacy data to reflect the new UTC time change without reindexing?

[gfriedmann]

For splunk forwarders running on windows, i have found that you must restart the splunkd to have it recognize a system timezone change.

[jrodman · Accepted solution]

We store the timestamp values in UTC always, and just display them in the localtime where the server is configured, so changing the timezone of splunk should not damage the accuracy of the timestamps in any way.

What might be trouble is if the incoming log datastream does not declare its timezone, and thus the newly arriving data is interpreted differently from the historical data (one of them is probably wrong!)

[gkanapathy]

There is not. It's not entirely clear to me that this makes sense anyway, unless all the old data was incorrectly timestamped. If the old data was on Eastern, and was indexed as if it were on Eastern, then its timestamps should still be correct, notwithstanding subsequent changes to the time zone of new data.

Of course, if the timestamp was indexed wrong in the first place, it basically needs to be deleted and reindexed/re-imported.

[gkanapathy]

If your configuration or the data does not specify a time zone, then Splunk will assume that this data is is in the same time zone as the Splunk indexer. So there will be a different interpretation of timestamps unless all of them are explicitly set.