Getting Data In

Summary indexes and multiple time zones

sc0tt
Builder

In an environment that provides reporting across many different time zones, should summary searches run under a user set to the default system time, GMT time, or doesn't it matter since Splunk will adjust the time based on the user's time zone?

0 Karma

woodcock
Esteemed Legend

Generally, it doesn't matter because the _time field that is created for the events in the summary index is always normalized to GMT epoch. There is one thing to consider, though; if you are using any snap-to definitions, these may be effected by the user's Time zone value. For example, if your TZ offset is not an even-hour (I just read that North Korea is dropping 30 minutes from their TZ), then @h for one user may be 30 minutes different than @h for another user. The same concern exists for relative day specifiers anywhere they exist (not just for the snap-to part) because where midnight falls (e.g. where the DayChange time is), may be different for different users so the window for day can be different from user-to-user.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

The updated Splunk Add-on for Microsoft Windows helps customers search Windows events faster by reducing ...

What's New in Splunk Enterprise Security 8.8 and Beyond

Threats move at machine speed. Keeping up should not depend on having the biggest budget, the largest team, or ...

A Four-Part Event Series: State of Observability - Where AI Meets Performance

As AI agents take on more complex tasks, teams need greater visibility into how they behave, what they cost, ...