Configure user language and locale

When a user logs in, Splunk automatically uses the language that the user's browser is set to. To switch languages, change the browser's locale setting. Locale configurations are browser-specific.

Splunk detects locale strings. A locale string contains two components: a language specifier and a localization specifier. This is usually presented as two lowercase letters and two uppercase letters linked by an underscore. For example, "en_US" means US English and "en_GB" means British English.

The user's locale also affects how dates, times, numbers, etc., are formatted, as different countries have different standards for formatting these entities.

Splunk provides built-in support for these locales:

de_DE
en_GB        
en_US
fr_FR
it_IT        
ja_JP 
ko_KR     
zh_CN
zh_TW

If you want to add localization for additional languages, refer to "Translate Splunk" in the Developer manual for guidance. You can then tell your users to specify the appropriate locale in their browsers.

How browser locale affects timestamp formatting

By default, timestamps in Splunk are formatted according the browser locale. If the browser is configured for US English, the timestamps are presented in American fashion: MM/DD/YYYY:HH:MM:SS. If the browser is configured for British English, then the timestamps will be presented in the European date format: DD/MM/YYYY:HH:MM:SS.

For more information on timestamp formatting, see Configure timestamp recognition in Getting Data In.

You can also specify how the timestamps appear in your search output by including formatting directly in your search. See Date and time format variables in the Search Reference.

Override the browser locale

The locale that Splunk uses for a given session can be changed by modifying the URL that you use to access Splunk. Splunk URLs follow the form http://host:port/locale/.... For example, when you access Splunk to log in, the URL might appear as https://hostname:8000/en-US/account/login for US English. To use British English settings, you can change the locale string to https://hostname:8000/en-GB/account/login. This session then presents and accepts timestamps in British English format for its duration.

Requesting a locale for which the Splunk interface has not been localized results in the message: Invalid language Specified.

Refer to "Translate Splunk" in the Developer Manual for more information about localizing Splunk.