Feature Request: "normalizetouserprofiletz=t" for `fieldformat` and `convert` commands

[woodcock]

This is probably a very ineffective way to make a feature request but I see that there is a tag for it, so I thought I would give it a try.

I just answered a question about dealing with non- _time timestamps (see link at the bottom) and it occurred to me that Splunk really needs an option for the fieldformat and convert (and probably other) commands to tell them to present times to the user not in GMT (which is currently the only possible behavior, and should remain the default), but rather adjusted to the TZ that is set for the user in his Search Head profile. Perhaps something like "normalizetouserprofiletz=t" (defaults to "f") would work.

http://answers.splunk.com/answers/246642/how-to-configure-splunk-to-convert-multiple-dateti.html#ans...

[alacercogitatus]

Feature request? First check and see if it is here: http://wiki.splunk.com/Community:ERs

This is a community driven Wiki page with all of our Enhancement Requests. Once you see it on/not on the list, then open a support Ticket with relevant information. If you don't see it to the ER list, please add it so others may also see what you have in mind.

== Edit 1 ==
So, the link to the question has nothing to do with non-_time timestamps. By default, events are shown in the Event View with the TZ associated to the user profile. If the TZ is not defined in the user's profile, then Splunk uses the local system TZ of the search head.

[woodcock]

I have no idea how the wrong link got into my "question" but I have fixed the link to provide some context to my request. Eventually, I will open Support Ticket.

[martin_mueller]

The best way to submit feature requests is to open a case under your support entitlement.

[richgalloway]

@woodcock Consider submitting this feature request at https://ideas.splunk.com/

[martin_mueller]

E.g. https://ideas.splunk.com/ideas/E-I-72