Apply timezone offsets to timestamps

Apply timezone offsets to timestamps

If you're indexing data from different timezones, use timezone offsets to ensure that they're correctly correlated when you search. You can configure timezone offsets based on the host, source, or sourcetype of an event.

Configure timezone offsets in props.conf. By default, Splunk applies timezone offsets using these rules, in the following order:

1. Use the timezone in raw event data (for example, PST, -0800).

2. Use TZ if it is set in a stanza in props.conf and the event matches the host, source, or sourcetype specified by a stanza.

3. Use the timezone offset of the Splunk server that indexes the event.

Configure timezone offsets in props.conf

Use $SPLUNK_HOME/etc/system/README/props.conf.example as an example, or create your own props.conf. Make any configuration changes to a copy of props.conf in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/.

Configure timezone offsets by adding a TZ = key to a timestamp configuration stanza for a host, source, or sourcetype in props.conf. The Splunk TZ = key recognizes zoneinfo TZID's (See all the timezone TZ ID's in the zoneinfo (TZ) database). Set a TZ = value to a TZID to a desired timezone offset for any host, source, or sourcetype.

Examples

This example sets the timezone offset of events from host names that match the regular expression nyc.* to the Eastern time zone.

[host::nyc*]
TZ = US/Eastern

This example sets the timezone offset of events from sources in the path /mnt/ca/... to the Pacific time zone.

[source::/mnt/ca/...]
TZ = US/Pacific

zoneinfo (TZ) database

The zoneinfo database is a publicly maintained database of timezone values.

• UNIX versions of Splunk rely on a TZ database included with the UNIX distribution you're installing on. Most UNIX distributions store the database in the directory: /usr/share/zoneinfo.
• Solaris versions of Splunk store TZ information in this directory: /usr/share/lib/zoneinfo.
• Windows versions of Splunk ship with a copy of the TZ database.

Refer to the zoneinfo (TZ) database for values you can set as TZ = in props.conf.