Dashboards & Visualizations

How to display 2 different time (UTC and PST) in the dashboard table?

kkanand
Explorer

[| makeresults
| addinfo
| eval earliest=relative_time(info_min_time,"@d+7h")
| eval latest=relative_time(info_min_time,"@d+31h")
| fields earliest latest]| fields file_name batch_count entry_addenda_count total_debit_amount total_credit_amount |dedup file_name | eval total_debit_amount=total_debit_amount/100, total_credit_amount=total_credit_amount/100 | table _time file_name batch_count entry_addenda_count total_debit_amount total_credit_amount

I am using above query
But want to show 2 different time zone PST and UTC in the table. Right now the time shown is in UTC

 

new - 1.png

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk does not have means for converting times to a specified time zone.  Times are stored as UTC internally and displayed in the user's selected time zone.

You can add code to shift times by some interval to simulate different time zones:

 

 

| makeresults 
| eval latest=_time
| eval locallatest=strftime(latest,"%Y-%m-%d %H:%M:%S %Z")
| eval utclatest=strftime(relative_time(latest, "+5h"),"%Y-%m-%d %H:%M:%S %Z")
| eval pdtlatest=strftime(relative_time(latest, "-3h"),"%Y-%m-%d %H:%M:%S %Z")

 

 

This code produces 

_timelatestlocallatestpdtlatestutclatest
2022-09-30 13:43:2416645598042022-09-30 13:43:24 EDT2022-09-30 10:43:24 EDT2022-09-30 18:43:24 EDT

As you can see, despite the different hours Splunk still considers all of the times as being in the same zone. (I modified the time zone strings to fit the table.)  If you remove the time zones provided by Splunk (by removing " %Z" from the format strings) then you'll get something close to what you seek.  It will, however, be somewhat fragile.  Since the relationships among the times are fixed, they may not be correct near daylight saving time transitions.  They're also specific to users in a single time zone so someone in a different zone (or with a different selected time zone) won't see the correct times.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Splunk does not have means for converting times to a specified time zone.  Times are stored as UTC internally and displayed in the user's selected time zone.

You can add code to shift times by some interval to simulate different time zones:

 

 

| makeresults 
| eval latest=_time
| eval locallatest=strftime(latest,"%Y-%m-%d %H:%M:%S %Z")
| eval utclatest=strftime(relative_time(latest, "+5h"),"%Y-%m-%d %H:%M:%S %Z")
| eval pdtlatest=strftime(relative_time(latest, "-3h"),"%Y-%m-%d %H:%M:%S %Z")

 

 

This code produces 

_timelatestlocallatestpdtlatestutclatest
2022-09-30 13:43:2416645598042022-09-30 13:43:24 EDT2022-09-30 10:43:24 EDT2022-09-30 18:43:24 EDT

As you can see, despite the different hours Splunk still considers all of the times as being in the same zone. (I modified the time zone strings to fit the table.)  If you remove the time zones provided by Splunk (by removing " %Z" from the format strings) then you'll get something close to what you seek.  It will, however, be somewhat fragile.  Since the relationships among the times are fixed, they may not be correct near daylight saving time transitions.  They're also specific to users in a single time zone so someone in a different zone (or with a different selected time zone) won't see the correct times.

---
If this reply helps you, Karma would be appreciated.

kkanand
Explorer

It worked!!!!!!!!!!!

Thank you so much

 

kkanand_0-1664576876883.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It almost works.  The "PDT_Time_Zone" column has values that say "UTC", which I would find confusing as a user.  Take " %Z" out of the strftime functions to fix that.

---
If this reply helps you, Karma would be appreciated.
0 Karma

kkanand
Explorer

I just noticed that my search is not giving out right results

Time range is selected : 09/26 to 9/29

 But its showing results for  (9/26/22 7:00:00.000 AM to 9/27/22 7:00:00.000 AM)

 

capt 2.png

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The earliest and latest fields in the query override the time picker.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...