Splunk Search

Splunk and timezones

tb5821
Communicator

In our splunk instance I believe the props.config file is set to UTC as that is what most of our logs are in but we do have some that are in the local time zone. Since I do not have access to edit the props file is there a way to specify in search that all these logs should be considered EST?

Tags (2)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Not really. You can of course compute the difference yourself, but the timestamp (along with host/source/sourcetype, and event breaks) is one of the only things that actually needs to be specified correctly when the data is indexed. Basically, if you don't index with the correct time zone (which means the correct time) then the data can't be found under the correct time. Your admin needs to fix the input data, as basically right now, it's wrong.

linu1988
Champion

If you can calculate and evaluate the time difference, the search result will come as you want.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...