Splunk Search

Global Summary date format ignores locale

landau351
Engager

Splunk 4.1.5 build 85165 Win32

I have used the tips/hacks listed in this forum to copy en_GB to en_AU.

The Search Summary page here; http://:8000/en-AU/app/search/dashboard still shows the 'Earliest event' and 'Latest event' dates as MM/DD/YYYY.

It appears to be displayed correctly in the actual search screens. Can these dates follow the locale as well?

Tags (2)
0 Karma

dskillman
Splunk Employee
Splunk Employee

http://splunk-base.splunk.com/answers/1488/create-australian-locale

This only changes the dates in the results sets. If you are looking at the Summary pages when you first log in they are hardcoded with the US format. You will need to change the XML to show the non-US format.

on whatever page you are on append ?showsource=1

You will see at the bottom in the XML window that there are lines like: …………fieldformat "Last Update"=strftime('Last Update', "%m/%d/%Y %T")

Modify them to say "%d/%m/%Y %T" and you should be good.

You can change the search/XML in the Manager--> User interface --> Views to the format you want.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...