Can the UI display the time stamp of my events in another format than MM/DD/YYYY?

[hexx]

The UI is displaying the time stamp of my events in US format (MM/DD/YYYY), but I would like the time format to be different. For example, what can I do to have the time stamp of my events be presented in European format (DD/MM/YYYY)?

[hexx · Accepted solution]

SplunkWeb's default time format display will be tied to the locale of the browser used to access the Splunk instance, as is described in the admin manual :

http://www.splunk.com/base/Documentation/4.1.4/admin/Userlanguageandlocale#How_browser_locale_affect...

This setting can be overridden by changing the URL you feed to your browser to access SplunkWeb, as described here :

http://www.splunk.com/base/Documentation/4.1.4/admin/Userlanguageandlocale#Override_the_browser_loca...

For example, change the following URL :

http://my-splunk-indexer:8000/en-US/app/search/dashboard

...to :

http://my-splunk-indexer:8000/en-GB/app/search/dashboard

...in order to display the time stamp of your events in European format.

Do note that at this time, Splunk only provides built-in support for a limited number of locales :

en_GB        
en_US        
ja_JP      
zh_CN
zh_TW

[jrodman]

There's a clumsy hack to use another locale, if necessary. You can copy the splunk locale directory to another locale name to get english text from the splunk app with other settings for an alternate locale. Our user surveys suggested this was unacceptably confusing so we did not make it an easy action out of the box.