Getting Data In

Searching indexes with your timezone set differently to the data's timezone

mtmoore
Explorer

Our data's date field uses UTC for all data across the globe for this one set of data. This is fine.

When a user runs a search using earliest and latest, unless I am mistaken, the date/time field it uses will be the timestamp placed on the data by Splunk and not the date field that is in the logs.

This is all well and good if the 2 date/times match up - even then though the user can change their timezone and this goes out of whack.

How can I force the search to look at the last 7 days using the UTC date/time stamp within the log itself and not Splunk's date/time stamp?

Thanks!

Tags (1)
0 Karma

blebit
Path Finder

or you can edit from your server

props.conf

[host:: the_host]
TZ = Location_TimeZone

0 Karma

mtmoore
Explorer

How will this force a search to use the date time zone of the raw log as opposed to the Splunk date/time based on your personal timezone settings?

0 Karma

blebit
Path Finder

props.conf @ remote location

TZ=Location_TimeZone

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...