https://community.splunk.com/t5/Splunk-Search/set-timezone-in-search/m-p/247180#M73728 <P>The following will convert from the timezone of your user account to UTC. You could use it in a subsearch to set earliest/latest in your search.</P> <P>| makeresults<BR /> | eval myTime=_time<BR /> | eval showMyTime=strftime(myTime,"%H:%M")<BR /> | eval myZone=strftime(myTime,"%z")<BR /> | eval UTC=myTime-((myZone/100) *3600)<BR /> | eval showUTC=strftime(UTC,"%H:%M")</P> Thu, 19 Oct 2017 20:51:21 GMT rrice_splunk 2017-10-19T20:51:21Z https://community.splunk.com/t5/Splunk-Search/set-timezone-in-search/m-p/247178#M73726 <P>most of my data sets to UTC, and all data sources are properly tagged to convert to UTC if they are not.</P> <P>My user is in PST, so when I run a search such as @d etc, it starts from midnight PST. Usually this is ok, as dashboards are built with this in mind.</P> <P>I have an extra use case for monitoring our splunk license usage, Splunk however runs it's license metrics based on 0-24:00 UTC. Any search I run for "last day" is going to be off by 1/3 based on this time difference.</P> <P>Is there a way to set a specific search to ignore the associated users search head timezone setting and run in UTC (or other specification) on that search?</P> Mon, 25 Jan 2016 20:27:47 GMT https://community.splunk.com/t5/Splunk-Search/set-timezone-in-search/m-p/247178#M73726 GeorgeStarkey 2016-01-25T20:27:47Z https://community.splunk.com/t5/Splunk-Search/set-timezone-in-search/m-p/247179#M73727 <P>Try something like in your searches to specify time range</P> <PRE><CODE>your base search [| gentimes start=-1 | eval UTCOffset=strptime(strftime(now(),"%m/%d/%Y %H:%M:%S")." UTC","%m/%d/%Y %H:%M:%S %Z") - now() | addinfo | eval earliest=info_min_time+UTCOffset | eval latest=info_max_time+UTCOffset | table earliest latest | format "" "" "" "" "' ""] | rest of the search </CODE></PRE> Mon, 25 Jan 2016 21:01:13 GMT https://community.splunk.com/t5/Splunk-Search/set-timezone-in-search/m-p/247179#M73727 somesoni2 2016-01-25T21:01:13Z https://community.splunk.com/t5/Splunk-Search/set-timezone-in-search/m-p/247180#M73728 <P>The following will convert from the timezone of your user account to UTC. You could use it in a subsearch to set earliest/latest in your search.</P> <P>| makeresults<BR /> | eval myTime=_time<BR /> | eval showMyTime=strftime(myTime,"%H:%M")<BR /> | eval myZone=strftime(myTime,"%z")<BR /> | eval UTC=myTime-((myZone/100) *3600)<BR /> | eval showUTC=strftime(UTC,"%H:%M")</P> Thu, 19 Oct 2017 20:51:21 GMT https://community.splunk.com/t5/Splunk-Search/set-timezone-in-search/m-p/247180#M73728 rrice_splunk 2017-10-19T20:51:21Z