Recently I observed that the axis in Horizon Chart is not following the timezone setting by the user. Please refer to the images below,
The user with timezone setting as GMT+0800
The user with timezone setting as GMT
Do I have any method that I can apply the timezone configured by the user in Splunk on the axis?
| makeresults count=2
| streamstats count
| eval _time = if (count==2,relative_time(_time,"-24h@m"), relative_time(_time,"@m"))
| makecontinuous span=30m
| eval col1=random() % 20, col2=random() % 20, col3=random() % 20
| fieldformat _time = strftime(_time,"%c %:::z")
| table _time col*
| eval COMMENT AS "this is sample data"
It runs in local time
In the worst case, add the following command:
| eval _time = relative_time (_time, "The timezone offset from UTC")
| makeresults count=2
| streamstats count
| eval _time = if (count==2,relative_time(_time,"-24h@m"), relative_time(_time,"@m"))
| makecontinuous span=30m
| eval col1=random() % 20, col2=random() % 20, col3=random() % 20
| fieldformat _time = strftime(_time,"%c %:::z")
| table _time col*
| eval COMMENT AS "this is sample data"
It runs in local time
In the worst case, add the following command:
| eval _time = relative_time (_time, "The timezone offset from UTC")
I know its over a year later - but did you resolve this ? I would like to know why Horizon Chart doesnt use the localised _time generated by | timestamp but instead uses the UTC timestamp from the event