Getting Data In

Display user specific timezone in Dasboard

basilarockiaedw
Path Finder

I changed the user specific timezone through the Manager > Your Account management pane.
Now I got a requirement to display user chosen timezone in the dashboard he/she is viewing.
do we have any such values in splunk which holds the user specific configuration info?

Thanks,
Basil

0 Karma
1 Solution

woodcock
Esteemed Legend

It displays the events in the user's personal TZ setting already. All of the Timepicker values take this into account, too (e.g. "yesterday" is different depending on your TZ setting). The things is that you cannot, by default, see this. Here is what you have to do.
Run a search.
Go to Events tab.
Look at the leftmost control in the row of controls that exists below the timeline and above the events area. This can have 1 of 3 values: Raw, List or Table; make sure it is NOT Raw, I prefer List.
There is now a column to the right of the i information column called either Time or _time.
THIS is the user-TZ-normalized time value for the event.

View solution in original post

0 Karma

chuckers
Path Finder

I have a solution that works beautifully to display the user's selected time zone on a dashboard. I typically display it in the label for the time picker and the X axis labels of all timeline visualizations.

Step 1. Make a hidden single value panel that pulls one event (usually just looking back one second is enough).
Step 2. From that one event, first I get the _time field (which HAS been offset by the user's TZ preference selection).
Step 3. Then I do your own extraction of the timestamp from the _raw event (with a rex command) this time has NOT been shifted.
Step 4. Then I subtract those two times to see how far from GMT they the user has shifted their data.

Step 5. I then use a case statement in eval to convert the time offset to a user friendly string. For example, a -8 hour shift from GMT might get converted to something like "Pacific time (GMT -8h)"
Step 6. Display the desired timezone string in the (hidden) single value panel.

Step 7. I add some XML to save the value in the panel to a token.
Step 8. Use that token where ever you desire to display the user's selected time zone.

Beware of the fact that in some places you have two possibilities for any given offset (Daylight savings time and standard time). I usually account for that in my case statement (Step 5) by rather crudely assuming that Nov-Feb are Daylight Savings time and the other months are not. (This works for my location but might need to be tweaked for your location.

I can provide some sample XML to get anybody going in the right direction.

0 Karma

woodcock
Esteemed Legend

It displays the events in the user's personal TZ setting already. All of the Timepicker values take this into account, too (e.g. "yesterday" is different depending on your TZ setting). The things is that you cannot, by default, see this. Here is what you have to do.
Run a search.
Go to Events tab.
Look at the leftmost control in the row of controls that exists below the timeline and above the events area. This can have 1 of 3 values: Raw, List or Table; make sure it is NOT Raw, I prefer List.
There is now a column to the right of the i information column called either Time or _time.
THIS is the user-TZ-normalized time value for the event.

0 Karma

basilarockiaedw
Path Finder

got a workaround.

Use this below search to get user specific timezone.

| rest /services/authentication/current-context|fields tz

Thanks,
Basil

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...

Splunk Smartness with Patrick Tatro | Episode 4

Welcome to another episode of "Splunk Smartness," where we explore how Splunk Education can revolutionize your ...