Documentation: 3.0.2
|  Print Version Contents
This page last updated: 10/15/07 06:10pm

How to configure timezone offsets

You can configure Splunk to set timezone offsets for your data. Use POSIX timezone settings; see man tzset for format help.

Timezones are set in the following order:
1. If the event contains a timezone specifier with a date, that is used as the timezone (e.g, 11:59 PM PST).
2. Otherwise, if the TZ attribute is set for the event's source or host, that is used as the timezone.
3. Otherwise, the timezone of the local machine is used.

Please note: Begining in March 2007, daylight time in the United States will begin on the second Sunday in March and end on the first Sunday in November. Be sure to install your OS vendor's daylight time patch to ensure that your events get logged with the correct DST timezone.

Configuration

To configure timezone offsets, create an entry in props.conf, linking your timezone to a specific host, source or sourcetype.

props.conf

Add a stanza to $SPLUNK_HOME/etc/bundles/local/props.conf:

[<spec>]
TZ = $POSIX_STRING

<spec> can be:
1. <sourcetype>, the sourcetype of an event
2. host::<host>, where <host> is the host for an event
3. source::<source>, where <source> is the source for an event

TZ is a timezone in POSIX format, such as the example below:

EST-5EDT01:00:00,M3.2.0/02:00:00,M11.1.0/02:00:00

Examples:

This example would set all events from hostnames that match the regular expression nyc.* to Eastern Time Zone.

[host::nyc*]
TZ = EST-5EDT01:00:00,M3.2.0/02:00:00,M11.1.0/02:00:00

This example maps a source pathname to a timezone.

[source::/mnt/nyc/...]
TZ = EST-5EDT01:00:00,M3.2.0/02:00:00,M11.1.0/02:00:00

Posix TZ formats

(The following text is adapted from the GNU man page )

Splunk accepts two formats for time zones.

The first format is used when there is no Daylight Saving Time (or summer time) in the local time zone:

std offset

The std string specifies the name of the time zone. It can be any alphabetical string three or more characters long, but must not contain a leading colon, embedded digits, commas, nor plus and minus signs. There is no space character separating the time zone name from the offset, so these restrictions are necessary to parse the specification correctly.

The offset specifies the time value you must add to the local time to get a Coordinated Universal Time value. It has syntax like [+|-]hh[:mm[:ss]]. This is negative if the local time zone is west of the Prime Meridian and positive if it is east. The hour must be between 0 and 23, and the minute and seconds between 0 and 59.

For example, here is how we would specify Eastern Standard Time, but without any Daylight Saving Time alternative. The std is "EST" and the offset is "-5".

EST-5

The second format is used when there is Daylight Saving Time:

std offset dst [offset],start[/time],end[/time]

The initial std and offset specify the standard time zone, as described above. The dst string and offset specify the name and offset for the corresponding Daylight Saving Time zone; if the offset is omitted, it defaults to one hour ahead of standard time.

The remainder of the specification describes when Daylight Saving Time is in effect. The start field is when Daylight Saving Time goes into effect and the end field is when the change is made back to standard time. The following formats are recognized for these fields:

  • Jn

This specifies the Julian day, with n between 1 and 365. February 29 is never counted, even in leap years.

  • n

This specifies the Julian day, with n between 0 and 365. February 29 is counted in leap years.

  • Mm.w.d

This specifies day d of week w of month m. The day d must be between 0 (Sunday) and 6. The week w must be between 1 and 5; week 1 is the first week in which day d occurs, and week 5 specifies the last d day in the month. The month m should be between 1 and 12.

The time fields specify when, in the local time currently in effect, the change to the other time occurs. If omitted, the default is 02:00:00.

Examples

US Eastern

  • Without Daylight Savings

TZ=EST-5

  • With US Daylight Savings time rules

TZ=EST-5EDT01:00:00,M3.2.0/02:00:00,M11.1.0/02:00:00

US Central

  • Without Daylight Savings Time

TZ=CST-6

  • With US Daylight Savings Time rules

TZ=CST-6CDT01:00:00,M3.2.0/02:00:00,M11.1.0/02:00:00

US Mountain

  • Without Daylight Savings Time

TZ=MST-7

  • With US Daylight Savings Time rules

TZ=MST-7EDT01:00:00,M3.2.0/02:00:00,M11.1.0/02:00:00

US Pacific

  • Without Daylight Savings Time

TZ=PST-8

  • With US Daylight Savings Time rules

TZ=PST-8PDT01:00:00,M3.2.0/02:00:00,M11.1.0/02:00:00

US Alaska

  • Without Daylight Savings Time

TZ=AKST-9

  • With US Daylight Savings Time rules

TZ=AKST-9PDT01:00:00,M3.2.0/02:00:00,M11.1.0/02:00:00

US Hawaii

  • Without Daylight Savings Time

TZ=HST-10

  • With US Daylight Savings Time rules

TZ=HST-10HDT01:00:00,M3.2.0/02:00:00,M11.1.0/02:00:00

Western Europe - UK and Ireland

  • Without Daylight Savings Time

TZ=GMT+0

  • With EU Daylight Savings Time rules

TZ=GMT+0BST01:00:00,M3.5.0/01:00:00,M10.5.0/02:00:00

Central Europe - Netherlands and Germany

  • Without Daylight Savings Time

TZ=CET+1

  • With EU Daylight Savings Time rules

TZ=CET+1CEST01:00:00,M3.5.0/02:00:00,M10.5.0/03:00:00

Japan

  • Japan does not implement Daylight Savings Time

TZ=JST+9

Previous: Train Splunk to recognize timestamps    |    Next: Tune Timestamping

Comments

No comments have been submitted.

Log in to comment.