https://community.splunk.com/t5/Splunk-Search/How-do-I-localize-date-mday/m-p/65878#M16342 <P>I don't think you can, at least not easily. The problem is that <CODE>date_mday</CODE> and all the other <CODE>date_*</CODE> fields are determined at index time. So these are static values that cannot be shifted to adjust for timezone at search time.</P> <P>You can however build your own field that contains the day with an <CODE>eval</CODE> command like this:</P> <PRE><CODE> ... | eval mday=strftime("%d", _time) | chart ... by mday </CODE></PRE> <P>So from there you will probably get the exact same value that <CODE>date_mday</CODE> already contains, so what you'll have to do is find the correct timezone offset and adjust for that manually. For example, if are 1 hour off GMT, then you could use:</P> <PRE><CODE> ... | eval mday=strftime("%d", _time+3600) </CODE></PRE> <P>If you have different servers in different timezones that this gets more complicated. You may be able to leverage the fact that <CODE>date_zone</CODE> contains the timezone offset in minutes within your timezone calculations. (It also contains the word "local", so'll have to filter that out, something like: </P> <PRE><CODE> ... | eval tz_offset_secs=if(date_zone=="local", 0, date_zone*60) </CODE></PRE> <P></P><HR /><P></P> <P>Related question:</P> <UL> <LI><A href="http://answers.splunk.com/questions/4528/finding-your-local-timezone-with-eval" rel="nofollow">Finding your local timezone with eval?</A></LI> </UL> Thu, 07 Oct 2010 20:29:03 GMT Lowell 2010-10-07T20:29:03Z https://community.splunk.com/t5/Splunk-Search/How-do-I-localize-date-mday/m-p/65877#M16341 <P>When I use chart using date_mday as a parameter, it is in GMT. Is there any way to make this the date for my local time zone? </P> Thu, 07 Oct 2010 07:22:42 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-localize-date-mday/m-p/65877#M16341 zzztimbo 2010-10-07T07:22:42Z https://community.splunk.com/t5/Splunk-Search/How-do-I-localize-date-mday/m-p/65878#M16342 <P>I don't think you can, at least not easily. The problem is that <CODE>date_mday</CODE> and all the other <CODE>date_*</CODE> fields are determined at index time. So these are static values that cannot be shifted to adjust for timezone at search time.</P> <P>You can however build your own field that contains the day with an <CODE>eval</CODE> command like this:</P> <PRE><CODE> ... | eval mday=strftime("%d", _time) | chart ... by mday </CODE></PRE> <P>So from there you will probably get the exact same value that <CODE>date_mday</CODE> already contains, so what you'll have to do is find the correct timezone offset and adjust for that manually. For example, if are 1 hour off GMT, then you could use:</P> <PRE><CODE> ... | eval mday=strftime("%d", _time+3600) </CODE></PRE> <P>If you have different servers in different timezones that this gets more complicated. You may be able to leverage the fact that <CODE>date_zone</CODE> contains the timezone offset in minutes within your timezone calculations. (It also contains the word "local", so'll have to filter that out, something like: </P> <PRE><CODE> ... | eval tz_offset_secs=if(date_zone=="local", 0, date_zone*60) </CODE></PRE> <P></P><HR /><P></P> <P>Related question:</P> <UL> <LI><A href="http://answers.splunk.com/questions/4528/finding-your-local-timezone-with-eval" rel="nofollow">Finding your local timezone with eval?</A></LI> </UL> Thu, 07 Oct 2010 20:29:03 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-localize-date-mday/m-p/65878#M16342 Lowell 2010-10-07T20:29:03Z https://community.splunk.com/t5/Splunk-Search/How-do-I-localize-date-mday/m-p/65879#M16343 <P>Just to be accurate, if <CODE>date_zone</CODE> is <CODE>local</CODE>, then the offset you use should be the offset of the indexer's local time zone. This would only be zero if the indexer was running on UTC/GMT, but is fixed and known for any given indexer.</P> Thu, 07 Oct 2010 22:08:44 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-localize-date-mday/m-p/65879#M16343 gkanapathy 2010-10-07T22:08:44Z