Global Summary date format ignores locale

[landau351]

Splunk 4.1.5 build 85165 Win32

I have used the tips/hacks listed in this forum to copy en_GB to en_AU.

The Search Summary page here; http://:8000/en-AU/app/search/dashboard still shows the 'Earliest event' and 'Latest event' dates as MM/DD/YYYY.

It appears to be displayed correctly in the actual search screens. Can these dates follow the locale as well?

[dskillman]

http://splunk-base.splunk.com/answers/1488/create-australian-locale

This only changes the dates in the results sets. If you are looking at the Summary pages when you first log in they are hardcoded with the US format. You will need to change the XML to show the non-US format.

on whatever page you are on append ?showsource=1

You will see at the bottom in the XML window that there are lines like: …………fieldformat "Last Update"=strftime('Last Update', "%m/%d/%Y %T")

Modify them to say "%d/%m/%Y %T" and you should be good.

You can change the search/XML in the Manager--> User interface --> Views to the format you want.