topic Re: How to display 2 different time (UTC and PST) in the dashboard table? in Dashboards & Visualizations

How to display 2 different time (UTC and PST) in the dashboard table?

kkanand — Fri, 30 Sep 2022 17:06:46 GMT

[| makeresults
| addinfo
| eval earliest=relative_time(info_min_time,"@d+7h")
| eval latest=relative_time(info_min_time,"@d+31h")
| fields earliest latest]| fields file_name batch_count entry_addenda_count total_debit_amount total_credit_amount |dedup file_name | eval total_debit_amount=total_debit_amount/100, total_credit_amount=total_credit_amount/100 | table _time file_name batch_count entry_addenda_count total_debit_amount total_credit_amount

I am using above query
But want to show 2 different time zone PST and UTC in the table. Right now the time shown is in UTC

Re: How to display 2 different time (UTC and PST) in the dashboard table?

richgalloway — Fri, 30 Sep 2022 18:02:38 GMT

Splunk does not have means for converting times to a specified time zone. Times are stored as UTC internally and displayed in the user's selected time zone.

You can add code to shift times by some interval to simulate different time zones:

| makeresults | eval latest=_time | eval locallatest=strftime(latest,"%Y-%m-%d %H:%M:%S %Z") | eval utclatest=strftime(relative_time(latest, "+5h"),"%Y-%m-%d %H:%M:%S %Z") | eval pdtlatest=strftime(relative_time(latest, "-3h"),"%Y-%m-%d %H:%M:%S %Z")

This code produces

_time	latest	locallatest	pdtlatest	utclatest
2022-09-30 13:43:24	1664559804	2022-09-30 13:43:24 EDT	2022-09-30 10:43:24 EDT	2022-09-30 18:43:24 EDT

As you can see, despite the different hours Splunk still considers all of the times as being in the same zone. (I modified the time zone strings to fit the table.) If you remove the time zones provided by Splunk (by removing " %Z" from the format strings) then you'll get something close to what you seek. It will, however, be somewhat fragile. Since the relationships among the times are fixed, they may not be correct near daylight saving time transitions. They're also specific to users in a single time zone so someone in a different zone (or with a different selected time zone) won't see the correct times.

Re: How to display 2 different time (UTC and PST) in the dashboard table?

kkanand — Fri, 30 Sep 2022 22:28:04 GMT

It worked!!!!!!!!!!!

Thank you so much

Re: How to display 2 different time (UTC and PST) in the dashboard table?

richgalloway — Sat, 01 Oct 2022 00:39:48 GMT

It almost works. The "PDT_Time_Zone" column has values that say "UTC", which I would find confusing as a user. Take " %Z" out of the strftime functions to fix that.

Re: How to display 2 different time (UTC and PST) in the dashboard table?

kkanand — Sat, 01 Oct 2022 03:58:09 GMT

I just noticed that my search is not giving out right results

Time range is selected : 09/26 to 9/29

But its showing results for (9/26/22 7:00:00.000 AM to 9/27/22 7:00:00.000 AM)

Re: How to display 2 different time (UTC and PST) in the dashboard table?

richgalloway — Sat, 01 Oct 2022 12:28:29 GMT

The earliest and latest fields in the query override the time picker.