Getting Data In

Does Splunk take into consideration Timezone Daylight Saving ?

DavidHourani
Super Champion

Hello Splunkies and Splunklemen ,

Does Splunk Automatically take into consideration Daylight Savings Time (DST) ? Or should this parameter be defined somewhere ?

If so can anyone tell me how its done via props.conf ?

Thanks !

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

IMHO, unless each event specifies TZ inside the event timestamp, you should always set TZ by host in props.conf like this:

# Tuscon
[host::My\.Host\.IP\.Here]
TZ = US/Mountain

View solution in original post

woodcock
Esteemed Legend

IMHO, unless each event specifies TZ inside the event timestamp, you should always set TZ by host in props.conf like this:

# Tuscon
[host::My\.Host\.IP\.Here]
TZ = US/Mountain

darlas
Communicator

I think I spoke too soon! Looks like _time is now reflecting daylight savings time. Thanks so much!

darlas
Communicator

In my situation, I have defined TZ=PST in my props.conf file for the particular event source. My Splunk servers are all in UTC. This worked fine until recently when we moved the clocks up an hour for daylight savings time. So now it seems my TZ should = PDT, but there is not such a value. Also this means I would have to change this 2x/year when we change the clocks..and in each props.conf file. Am I missing something here? How do I handle this situation?

Thanks!!!

woodcock
Esteemed Legend

The "US/" notation implies DST, which is one of the reasons I used it in my answer. You need "US/Pacific" to handle DST changes.

0 Karma

darlas
Communicator

Thanks for the quick reply! I changed my props.conf but does not seem to be changing the behavior. I've given it about 30 minutes just in case it took time to affect the events. I'll have to keep digging.

0 Karma

DavidHourani
Super Champion

Cool! Thank you. This goes on the indexer right ? Would it modify _time for all the logs or only the recently added ones ?

0 Karma

woodcock
Esteemed Legend

Only new ones that come in after the indexer has Splunk restarted. You can track which events have updated TZs and which do not by looking at the date_zone field. Don't forget to "Accept" my answer!

0 Karma

DavidHourani
Super Champion

Thanks mate!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...