Adding update to tzdata

[nwang92]

Addresses #458

[Treverr]

Any idea when this will go into a release? I spent hours trying to figure out why Splunk searches were always in UTC time and this is the issue.

[nwang92]

@Treverr we generally pair the release cadence of these Docker images with Splunk Enterprise releases. However, we also have a nightly build published at splunk/splunk:edge if you'd like to take advantage of this change sooner!

[Treverr]

@Treverr we generally pair the release cadence of these Docker images with Splunk Enterprise releases. However, we also have a nightly build published at splunk/splunk:edge if you'd like to take advantage of this change sooner!

Thank you! I was able to get into the docker and fix this for now but didn't want it to revert or anything on update (plus for new installs).

[alishamayor]

@Treverr This fix has been included in the v8.1.3 Docker images just published to Docker Hub.

[abhinavprateek]

@Treverr we generally pair the release cadence of these Docker images with Splunk Enterprise releases. However, we also have a nightly build published at splunk/splunk:edge if you'd like to take advantage of this change sooner!

Thank you! I was able to get into the docker and fix this for now but didn't want it to revert or anything on update (plus for new installs).

@Treverr what was the fix you did from inside docker? i tried using microdnf -y --nodocs update tzdata to install tzdata but still no effect

[jmyoung]

This is not fixed in the current splunk/splunk:edge. I had TZ issues with ingestion that was ultimately resolved with;

microdnf -y --nodocs reinstall tzdata

Note use of reinstall instead of update. And then adding TZ=Australia/Adelaide to the envvars for the container and restarting it. In case it's important, I'm using podman, but that shouldn't really matter.

[Treverr]

I am running splunk/splunk:latest and it seems to be ok for me.

[Treverr]

Correction- I updated mine and it is broken again.

[JoshSchwarz]

Just updated and I am seeing this same issue with splunk/splunk:latest. (Splunk is 8.2.1)

Followed the same process as @jmyoung got mine working again.

microdnf -y --nodocs reinstall tzdata

Then was able to set TZ to TZ=Australia/Adelaide using tzselect which resolved the issue. (Testing TZ docker variable as a permanent fix but yet to confirm.)

[alishamayor]

This should be fixed in the latest images (8.2.2).

[jmyoung]

Confirming that, I just pulled the current splunk/splunk:latest - version 8.2.2, image ID is 7fede25dde7a. Ingestion timestamps are normal, and the Search App's idea of timezone also looks normal.

For reference for others coming across this later, I'm using podman, and I am also use the --tz Australia/Adelaide and -e TZ=Australia/Adelaide parameters to Podman on container creation to set the timezone.

Thanks for fixing this!