Getting Data In

Moving Servers Timezone Issues

andrewkenth
Communicator

We are moving our Splunk server (everything is on this one server) however the old and new servers are in different timezones so all of my date before the move is now one hour earlier then it should be.

How can I stop this from happening? We have many dated only (no time) events and it is changing the day these events took place.

Thanks!

Tags (2)
0 Karma

andrewkenth
Communicator

How can I move the data in my pre move to a different time zone?

I am indexing w/o any time zone specification.

0 Karma

yannK
Splunk Employee
Splunk Employee
  • when the events are indexed, if there are no TZ specified, the events are considered as in the timezone of the indexer . Please check this http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/ApplyTimezoneOffsetsToTimeStamps
  • Events indexed in splunk are converted to epoch time, so once indexed the indexer can be moved to another timezone.
  • at search time, the timezone is specified by the search-head or the user profile. Verify your profiles.
0 Karma

yannK
Splunk Employee
Splunk Employee

There is no way to do that, the data indexed is "carved in stone".
You are better deleting and reindexing if you have the original data.
see http://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder

The only hack to display results correctly at search time, could be to search over larger timerange, then change the _time field selectively.
Example to add one hour to all your events :
<mysearch> <mylargertimerange> | eval _time=_time+60*60 | search <myfinaltimerange>

0 Karma

andrewkenth
Communicator

That is what I was thinking but how do I enforce a time zone on data that has already been imported?

0 Karma

yannK
Splunk Employee
Splunk Employee

I am indexing w/o any time zone specification.

then this is the issue, splunk default to the indexer timezone, that may not the same than your data, use the previous documentation link and enforce a timezone.

0 Karma

andrewkenth
Communicator

How can I move the data in my pre move to a different time zone?

I am indexing w/o any time zone specification.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...