Morning, Splunkers!
I've been running a dashboard that monitors the performance of the various systems my customer uses, and I recently switched all of my timechart line graphs over to the Downsampled Line Chart because it allows a user to zoom in on a specific time/date range that is already displayed (most of my customer's users aren't Splunk-savy in the slightest). My customer has users literally all over the country, so our Splunk is set for all times to be shown as UTC by default for every account.
The problem is the Downsampled Line Chart insists on showing everything in local time, regardless of what our account configurations are set to, and I can't find any documentation on how to get it to stop (I'm not an admin, so I can't just go into settings and start editing configuration files).
Does anybody have any idea on how to get it to stop? I'd hate to have to give up the functionality of the chart because it won't show the same times for people on opposite sides of the country, but I'm out of options, here.
Okay, I have more information. The problem seems to be related to timewrap.
For example, if I pull three days and put them in a timechart using the downsampled line chart visualization, I see everything displayed in UTC as expected.
However, if I, say, throw a "| timewrap 1d" in there, suddenly the visualization displays in local time while the statistics table continues to show UTC.
I'm flat out of ideas, folks, so if anyone has any suggestions I'd be glad to hear them.