Splunk Search

Our server's configured timezone offset (TZ) has been changed from Eastern to UTC. Do we need to take any steps?

Ellen
Splunk Employee
Splunk Employee

Is there a way to update the timestamp of the legacy data to reflect the new UTC time change without reindexing?

Tags (3)
1 Solution

jrodman
Splunk Employee
Splunk Employee

We store the timestamp values in UTC always, and just display them in the localtime where the server is configured, so changing the timezone of splunk should not damage the accuracy of the timestamps in any way.

What might be trouble is if the incoming log datastream does not declare its timezone, and thus the newly arriving data is interpreted differently from the historical data (one of them is probably wrong!)

View solution in original post

gfriedmann
Communicator

For splunk forwarders running on windows, i have found that you must restart the splunkd to have it recognize a system timezone change.

0 Karma

jrodman
Splunk Employee
Splunk Employee

We store the timestamp values in UTC always, and just display them in the localtime where the server is configured, so changing the timezone of splunk should not damage the accuracy of the timestamps in any way.

What might be trouble is if the incoming log datastream does not declare its timezone, and thus the newly arriving data is interpreted differently from the historical data (one of them is probably wrong!)

gkanapathy
Splunk Employee
Splunk Employee

There is not. It's not entirely clear to me that this makes sense anyway, unless all the old data was incorrectly timestamped. If the old data was on Eastern, and was indexed as if it were on Eastern, then its timestamps should still be correct, notwithstanding subsequent changes to the time zone of new data.

Of course, if the timestamp was indexed wrong in the first place, it basically needs to be deleted and reindexed/re-imported.

gkanapathy
Splunk Employee
Splunk Employee

If your configuration or the data does not specify a time zone, then Splunk will assume that this data is is in the same time zone as the Splunk indexer. So there will be a different interpretation of timestamps unless all of them are explicitly set.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...