topic Re: Can you specify timezone in a REST API search? in Splunk Search

Can you specify timezone in a REST API search?

jedatt01 — Wed, 25 Nov 2015 18:17:56 GMT

I'm using the REST API with a one-shot search to pull back some previously summarized information. The summary indexing was done with EST timezone so the events show up as 00:00:00 EST. The server i'm doing the REST API call from is on CST timezone. When I get the results back from the search they show up as the previous day because the timestamp ends up being 1 hour before at 23:00:00 CST - 1Day. This is completely screwing up my search results. Is there a way to force the API call to use EST timezone instead of the system default?

Note:
Changing the timezone on my server is not an option because it's a shared server.

Re: Can you specify timezone in a REST API search?

woodcock — Wed, 25 Nov 2015 20:00:51 GMT

Change the Time zone setting ( My UserName -> Edit Account -> Time zone ) for the user running the search (REST API call) and set it to EST.

Re: Can you specify timezone in a REST API search?

jedatt01 — Thu, 26 Nov 2015 01:53:51 GMT

I tried this and it first it didn't work. I waited some more time though then restarted my webserver and cleared cache on my client and now its working. Thank you!

Re: Can you specify timezone in a REST API search?

redflexigork — Thu, 15 Mar 2018 02:36:26 GMT

Can you elaborate what do you mean by clearing cache on the client?
I have the same problem, but not able to make it work with the same solution.

Re: Can you specify timezone in a REST API search?

bhatti009 — Fri, 08 May 2020 16:37:15 GMT

You can have Splunk server return UTC time
'original query' | eval time=_time | fields - _time