Dashboards & Visualizations

Downsampled Line Chart only shows local time

A_VA
Explorer

Morning, Splunkers!

I've been running a dashboard that monitors the performance of the various systems my customer uses, and I recently switched all of my timechart line graphs over to the Downsampled Line Chart because it allows a user to zoom in on a specific time/date range that is already displayed (most of my customer's users aren't Splunk-savy in the slightest). My customer has users literally all over the country, so our Splunk is set for all times to be shown as UTC by default for every account.

The problem is the Downsampled Line Chart insists on showing everything in local time, regardless of what our account configurations are set to, and I can't find any documentation on how to get it to stop (I'm not an admin, so I can't just go into settings and start editing configuration files).

Does anybody have any idea on how to get it to stop? I'd hate to have to give up the functionality of the chart because it won't show the same times for people on opposite sides of the country, but I'm out of options, here.

 

Labels (2)
0 Karma

A_VA
Explorer

Okay, I have more information. The problem seems to be related to timewrap.

For example, if I pull three days and put them in a timechart using the downsampled line chart visualization, I see everything displayed in UTC as expected.

However, if I, say, throw a "| timewrap 1d"  in there, suddenly the visualization displays in local time while the statistics table continues to show UTC.

I'm flat out of ideas, folks, so if anyone has any suggestions I'd be glad to hear them.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...