Getting Data In

TZ Issues When Searching

wbkendall
Explorer

Hello,

We're currently doing a pilot of Splunk. We have two servers - one is an indexer and the other a search head. We have a Linux syslog server that collects all firewall logs and forwards these to the indexer via the Universal Forwarder agent.

All firewalls are set to UTC. This causes an issue when searching for events, as we're in US Eastern time. The only way to get the relevant events to show up in searches is to effectively search in the future relative to our local time (ie compute UTC for the time desired, and search on those values).

I've checked and both the server and the dashboard are set to the correct time zone.

Is there a way to display the time locally in the dashboard while leaving it unmodified within the index?

Thanks!

Tags (1)
0 Karma

wbkendall
Explorer

Thanks everyone. I finally just ended up modifying the props.conf in /opt/splunkforwarder/etc/apps/Splunk_TA-cisco-asa/local/ with this value:

[host:::*]
TZ = US/Eastern

Thanks!

lukejadamec
Super Champion

Check out this information on how Splunk determines the TZ.

http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/ApplyTimezoneOffsetstotimestamps

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You may try setting the timezone of the users to UTC, so that when they search, time range will correspond to UTC.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...