User language and locale
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
User language and locale
When a user logs in, Splunk automatically uses the language that the user's browser is set to. To switch languages, change the browser's locale setting. Locale configurations are browser-specific.
Splunk detects locale strings. A locale string contains two components: a language specifier and a localization specifier. This is usually presented as two lowercase letters and two uppercase letters linked by an underscore. For example, "en_US" means US English and "en_GB" means British English.
The user's locale also affects how dates, times, numbers, etc., are formatted, as different countries have different standards for formatting these entities.
Splunk provides built-in support for these locales:
en_GB en_US ja_JP zh_CN zh_TW
If you want to add localization for additional languages, refer to "Translate Splunk" in the Developer manual for guidance. You can then tell your users to specify the appropriate locale in their browsers.
How browser locale affects timestamp formatting
By default, timestamps in Splunk are formatted according the browser locale. If the browser is configured for US English, the timestamps are presented in American fashion: MM/DD/YYYY:HH:MM:SS. If the browser is configured for British English, then the timestamps will be presented in the traditional European date format: DD/MM/YYYY:HH:MM:SS.
Override the browser locale
The locale that Splunk uses for a given session can be changed by modifying the url that you use to access Splunk. Splunk urls follow the form http://host:port/locale/.... For example, when you access Splunk to log in, the url may appear as http://hostname:8000/en-US/account/login for US English. To use British English settings, you can change the locale string to http://hostname:8000/en-GB/account/login. This session then presents and accepts timestamps in British English format for its duration.
Requesting a locale for which the Splunk interface has not been localized results in the message: Invalid language Specified.
Refer to "Translate Splunk" in the Developer Manual for more information about localizing Splunk.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.
Comments
I agree with Mark, should be a User Account setting, not a browser hack. Also, what I'm really after is to have all timestamps displayed as UTC, as our global logs are based on that. Right now, if I use the defaults, the actual log is in UTC but the timestamped results are in my local US timezone. I get around it by switching to en_GB, per this hack, but that can also get confusing due to the flip-flop of month and year.
Best solution: user option that let's me define what timezone, with UTC an option, and what format I want to see it in, in the form of a dropdown list. Then I can do my favored YY-MM-DD, others can do US standard MM-DD-YY, still others can do DD-MM-YY.
Tried the "override browser locale" with two browsers (from en-US to en-GB): no effect. That is: no effect on timestamps, still mm/dd/yyyy.
Hate this - should be a user account setting, not depending on browser setting.
Anyway - any idea how to fix this? Please feedback. mark.bouman@vtspn.nl Re. Mark
Good news: User-settable timezone is a feature in the upcoming 4.3 release, scheduled for January 2012. You set in Manager, on the page where you configure users.