Getting Data In

Summary indexes and multiple time zones

sc0tt
Builder

In an environment that provides reporting across many different time zones, should summary searches run under a user set to the default system time, GMT time, or doesn't it matter since Splunk will adjust the time based on the user's time zone?

0 Karma

woodcock
Esteemed Legend

Generally, it doesn't matter because the _time field that is created for the events in the summary index is always normalized to GMT epoch. There is one thing to consider, though; if you are using any snap-to definitions, these may be effected by the user's Time zone value. For example, if your TZ offset is not an even-hour (I just read that North Korea is dropping 30 minutes from their TZ), then @h for one user may be 30 minutes different than @h for another user. The same concern exists for relative day specifiers anywhere they exist (not just for the snap-to part) because where midnight falls (e.g. where the DayChange time is), may be different for different users so the window for day can be different from user-to-user.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...