topic how to view data based on different time zone? in Getting Data In

how to view data based on different time zone?

shankarananthth — Fri, 22 Jan 2016 10:15:01 GMT

Hi,

my splunk log is falling as charlotte time.

when people from dubai or London or Denver viewwing the report.
Report need to be displayed in their time zone.
Ex : if charlotte time is 5:08 AM now when people from london viewing the dashboard at same time, then dashboard data should show 10:08 AM data, because time is changing fro zone to zone.

Thanks in Advance

Re: how to view data based on different time zone?

chimell — Fri, 22 Jan 2016 11:02:08 GMT

Hi shankarananthth
The following link will help you just click on it and use

https://answers.splunk.com/answers/86587/convert-the-timezone-from-a-time-field.html

Re: how to view data based on different time zone?

shankarananthth — Tue, 29 Sep 2020 08:31:56 GMT

Hi Chimell,

I have already refereed that link and framed the query, but now the problem i facing.
How can i give that in drop down or multi select option and make it work for entire dashboard.

Query which i framed:

index="way" sourcetype="transactions" source="/env/transactionlog/*"
| transaction fields=MessageId keepevicted=true
| stats min(_time) AS startDate, max(_time) AS endDate | convert timeformat="%F %T" ctime(*Date)
| eval max=strftime(max, "%Y-%m-%d %T")
| eval DUBAIS= strptime(startDate, "%Y-%m-%d %T") +32400
| eval DUBAIE= strptime(endDate , "%Y-%m-%d %T") +32400
| eval DUBAI_START_TIME= strftime(DUBAIS, "%Y-%m-%d %H:%M:%S")
| eval DUBAI_END_TIME= strftime(DUBAIE, "%Y-%m-%d %H:%M:%S")
| table DUBAI_END_TIME

Re: how to view data based on different time zone?

shankarananthth — Tue, 29 Sep 2020 08:32:01 GMT

Hi,

I have already refereed the same link and developed the below Query.

index="way" sourcetype="transactions" source="/transactionlog/*"
| transaction fields=MessageId keepevicted=true
| stats min(_time) AS startDate, max(_time) AS endDate | convert timeformat="%F %T" ctime(*Date)
| eval max=strftime(max, "%Y-%m-%d %T")
| eval DUBAIS= strptime(startDate, "%Y-%m-%d %T") +32400
| eval DUBAIE= strptime(endDate , "%Y-%m-%d %T") +32400
| eval DUBAI_START_TIME= strftime(DUBAIS, "%Y-%m-%d %H:%M:%S")
| eval DUBAI_END_TIME= strftime(DUBAIE, "%Y-%m-%d %H:%M:%S")
| table DUBAI_START_TIME DUBAI_END_TIME

Problem which i'm facing,

How can i able to give the above query in multi-select.
I need to choose both the values need to be there in the filter.
When i choose that value it need to be reflected for entire dashboard.

Can u kindly give your valuable sugestion
Thanks in advance