Source Time Zone Searching

[cconkle]

I'm not sure if this is possible, but I'm trying to figure out if there is a way to see what the unadjusted original time stamp was on an event. I'm trying to search across global time zones (CST, PST, GMT, AWST, etc.) to see if regardless of timezone if an event occurred between certain hours. I can do (date_hour > 4 AND date_hour < 21) but that's only against the search users default time zone. I need to search between 4 and 21 in the original data time stamp if that's even possible.

I know I could tag sets of servers by time zone and then have one search per timezone but I would like to have a single search instead of lots of searches running, as well as avoid having to hand update the list everytime we add/remove a server.

Is this possible?

Thanks!

[somesoni2]

Below can give you the original timestamp that was present in the source/log file. You can utilize this to extract date parts and build your search

index=abc sourcetype=xyz | eval orig_time = substr(_raw,timestartpos, timeendpos-timestartpos)

[somesoni2]

It is definitely possible. Forwarders can specify which timezone to consider while forwarding the events to indexer. Have a look at "http://docs.splunk.com/Documentation/Splunk/latest/data/Applytimezoneoffsetstotimestamps".

[cconkle]

Is it possible that the forwarder is already doing something to that date/time before it hits the indexer? It seems like orig_time is always the same as the regular item time regardless of whether its a CST or GMT server.

[cconkle]

For some reason captcha won't let me remove the indextime search tag. This is not related to the indextime search app