Getting Data In

TZ Issues When Searching

wbkendall
Explorer

Hello,

We're currently doing a pilot of Splunk. We have two servers - one is an indexer and the other a search head. We have a Linux syslog server that collects all firewall logs and forwards these to the indexer via the Universal Forwarder agent.

All firewalls are set to UTC. This causes an issue when searching for events, as we're in US Eastern time. The only way to get the relevant events to show up in searches is to effectively search in the future relative to our local time (ie compute UTC for the time desired, and search on those values).

I've checked and both the server and the dashboard are set to the correct time zone.

Is there a way to display the time locally in the dashboard while leaving it unmodified within the index?

Thanks!

Tags (1)
0 Karma

wbkendall
Explorer

Thanks everyone. I finally just ended up modifying the props.conf in /opt/splunkforwarder/etc/apps/Splunk_TA-cisco-asa/local/ with this value:

[host:::*]
TZ = US/Eastern

Thanks!

lukejadamec
Super Champion

Check out this information on how Splunk determines the TZ.

http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/ApplyTimezoneOffsetstotimestamps

0 Karma

somesoni2
Revered Legend

You may try setting the timezone of the users to UTC, so that when they search, time range will correspond to UTC.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...