Drill-down changes timezones??

[nbcohen]

All of the data we collect with Splunk has a UTC (GMT) timestamp. Last week, I built a report and set the time period to 'previous week'. And the report looks good. The report is a breakdown of events by support groups. If I drill down into one of the support groups, the next page is off by 5 hours - instead of Nov 21 - Nov 27, it shows events for the support group from 5am Nov 21 to 5am Nov 28. If I change the 'custom time' to 'previous week', then the time slides back to midnight-midnight and my event counts line up properly.

Timezones are an area that always confuse me 🙂 Can someone tell me what I need to do to make this work properly? Do I need to set something in the report setup itself? My GUI options? Not sure where I should be looking...

Thanks very much,

nbc

[Simeon]

I believe there was a bug with respect to timezones in early 4.x versions. Basically, the drill down for the flashtimeline would pass along the wrong offset. It is very likely that this is your problem.

What are the respective timezones of your search head and browser client?

[nbcohen]

Browser client is EST. System time on my machine (where the browser runs) is kept in UTC. Not sure what you mean by search head...

Regarding the 4.x versions - is the bug in the indexer? I'll check and see what version we have installed... Thanks...