Dashboards & Visualizations

Drill-down changes timezones??


All of the data we collect with Splunk has a UTC (GMT) timestamp. Last week, I built a report and set the time period to 'previous week'. And the report looks good. The report is a breakdown of events by support groups. If I drill down into one of the support groups, the next page is off by 5 hours - instead of Nov 21 - Nov 27, it shows events for the support group from 5am Nov 21 to 5am Nov 28. If I change the 'custom time' to 'previous week', then the time slides back to midnight-midnight and my event counts line up properly.

Timezones are an area that always confuse me 🙂 Can someone tell me what I need to do to make this work properly? Do I need to set something in the report setup itself? My GUI options? Not sure where I should be looking...

Thanks very much,


Tags (2)
0 Karma

Splunk Employee
Splunk Employee

I believe there was a bug with respect to timezones in early 4.x versions. Basically, the drill down for the flashtimeline would pass along the wrong offset. It is very likely that this is your problem.

What are the respective timezones of your search head and browser client?


Browser client is EST. System time on my machine (where the browser runs) is kept in UTC. Not sure what you mean by search head...

Regarding the 4.x versions - is the bug in the indexer? I'll check and see what version we have installed... Thanks...

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...