Hi there,
I need some help regarding time zone (I think). I have data that was collected in Europe (CET time). My analysis system where I load the data into Splunk is in the Australian time zone (AEST). I seem to have misalignment between what I know happened on specific days and the dates/times displayed in Splunk. I believe it's due to Splunk interpreting the data to be in my time zone.
Is there somewhere in the configuration where I can tell Splunk that the data is from a specific time zone (apart from re-timestamping the data)?
Thanks,
Stan
Hello!
You can set your events timestamp via splunk Web http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Modifyeventprocessing
when indexing data, or by editing your props.conf http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Applytimezoneoffsetstotimestamps
Thanks.