How can we change the timezone for any particular app in splunk?

[471178]

i have already tried to change timezone by creating new user in access controls and setting timezone accordingly. But i want to make a specific role to set timezone for all the user accessing the app not for any specific user.Please suggest. I want to set us timezone for my app.

[jkat54]

You can't apply roles based on the app context. What you can do is modify every search saved in the app so that it evals the timezone you want.

For example:

| replace * with "* UTC" in origtime 
| eval newctime = strptime(origtime,"%Y-%m-%d %T %Z") 
| eval newstrtime = strftime(newctime,"%Y-%m-%d %T")

Here is a larger thread on the topic: https://answers.splunk.com/answers/4279/timezone-and-timestamp-modification-at-search-report-time.ht...