How to change UST timezone to PST time?

[karthi2809]

In my splunk dashboard i have table with time stamp of UST time .But my team is working in multiple timezone .So they want me to make default PST timezone in dashboard.How can we acheive this in splunk dashboard?

[sainag_splunk]

Hello! The key point is that Splunk stores all data in UTC, but displays it based on user preferences. This approach allows for flexibility without changing the actual data or dashboard configuration.

Here's an example to illustrate:

Let's say you have team members in New York (EST) and San Francisco (PST). An event occurs at 2:00 PM PST.

1. The event is stored in Splunk as 10:00 PM UTC.
2. The San Francisco team member (with PST preference) sees it as 2:00 PM.
3. The New York team member (with EST preference) sees it as 5:00 PM.

Both are looking at the same data, but it's displayed in their local time.

To achieve this:

1. Ensure correct timestamp configuration on data sources.
2. Each user sets their preferred timezone in Splunk settings.

This method maintains data consistency while accommodating different timezones without modifying dashboards.

Please Upvote if this is Helpful.