How to display 2 different time (UTC and PST) in the dashboard table?

[kkanand]

[| makeresults
| addinfo
| eval earliest=relative_time(info_min_time,"@d+7h")
| eval latest=relative_time(info_min_time,"@d+31h")
| fields earliest latest]| fields file_name batch_count entry_addenda_count total_debit_amount total_credit_amount |dedup file_name | eval total_debit_amount=total_debit_amount/100, total_credit_amount=total_credit_amount/100 | table _time file_name batch_count entry_addenda_count total_debit_amount total_credit_amount

I am using above query
But want to show 2 different time zone PST and UTC in the table. Right now the time shown is in UTC

[richgalloway · Accepted solution]

Splunk does not have means for converting times to a specified time zone.  Times are stored as UTC internally and displayed in the user's selected time zone.

You can add code to shift times by some interval to simulate different time zones:

| makeresults 
| eval latest=_time
| eval locallatest=strftime(latest,"%Y-%m-%d %H:%M:%S %Z")
| eval utclatest=strftime(relative_time(latest, "+5h"),"%Y-%m-%d %H:%M:%S %Z")
| eval pdtlatest=strftime(relative_time(latest, "-3h"),"%Y-%m-%d %H:%M:%S %Z")

This code produces 

_time	latest	locallatest	pdtlatest	utclatest
2022-09-30 13:43:24	1664559804	2022-09-30 13:43:24 EDT	2022-09-30 10:43:24 EDT	2022-09-30 18:43:24 EDT

As you can see, despite the different hours Splunk still considers all of the times as being in the same zone. (I modified the time zone strings to fit the table.)  If you remove the time zones provided by Splunk (by removing " %Z" from the format strings) then you'll get something close to what you seek.  It will, however, be somewhat fragile.  Since the relationships among the times are fixed, they may not be correct near daylight saving time transitions.  They're also specific to users in a single time zone so someone in a different zone (or with a different selected time zone) won't see the correct times.

[kkanand]

It worked!!!!!!!!!!!

Thank you so much

[richgalloway]

It almost works.  The "PDT_Time_Zone" column has values that say "UTC", which I would find confusing as a user.  Take " %Z" out of the strftime functions to fix that.

[kkanand]

I just noticed that my search is not giving out right results

Time range is selected : 09/26 to 9/29

 But its showing results for  (9/26/22 7:00:00.000 AM to 9/27/22 7:00:00.000 AM)

[richgalloway]

The earliest and latest fields in the query override the time picker.