Event Timeline Viz Timezone Displayed Not Aligned with Splunk Timezone Setting

[ianthomas]

Hello,

The Event Timeline Viz is well suited for some work I am doing for a customer to understand jobs/alerts.

I have discovered that it appears to display based on Computer/Browser timezone and NOT Splunk timezone settings in user preferences, which doesn't agree with everything else in Splunk and will be difficult/confusing to explain. 

If I change my Splunk user preference timezone, and was surprised to find that the Event Timeline Viz does not change the displayed times. Other visualizations and Splunk time does change for the same search results.

If I change my Computer timezone, Event Timeline viz does change how time is displayed and the "Now" line reflects that the new computer timezone. 

I emailed the author but wanted to post here to see if anyone else had seen this issue and/or addressed it.

Screenshot below was taken with Splunk UI set to Pacific/Honolulu time. The Now line aligns with computer timezone, not Splunk.

Thanks in advance for the help.

Ian

[danspav]

Hi @ianthomas,

Looks like that is a bug - I've never noticed it because my computer and Splunk time zones have always been in sync.

The issue comes because the "now" time is generated via JavaScript, and so it obeys the time zone of the local PC. I can make a tweak to ensure that the time zone set by Splunk is used to generate "now".

I'll let you know when I've posted an update to the app on Splunkbase.

Cheers.
Daniel

[danspav]

Version 1.9.0 of Event Timeline Viz is up on Splunkbase now:

https://splunkbase.splunk.com/app/4370

• Added support for different locales, based on what you've set in Splunk. Supported locales:
  English, Italian, Dutch, German, French
  Note that tooltips and example dashboards will still appear in English.
• Fixed bug where the time shown on the visualization was reflecting the time zone of the client OS, not the user preference set in Splunk.
• Fixed bug with the 'Disable Zoom' option where zoom could still be enabled when it was set to false.

[tscroggins]

Sweet. Thanks, @danspav. The Splunk community rocks!

[tscroggins]

Hi @ianthomas,

The Event Timeline Viz add-on is developed and supported by @danspav. You can contact them directly via email (see Splunkbase) or tag them as I have here for support.