Getting Data In

Summary indexes and multiple time zones

sc0tt
Builder

In an environment that provides reporting across many different time zones, should summary searches run under a user set to the default system time, GMT time, or doesn't it matter since Splunk will adjust the time based on the user's time zone?

0 Karma

woodcock
Esteemed Legend

Generally, it doesn't matter because the _time field that is created for the events in the summary index is always normalized to GMT epoch. There is one thing to consider, though; if you are using any snap-to definitions, these may be effected by the user's Time zone value. For example, if your TZ offset is not an even-hour (I just read that North Korea is dropping 30 minutes from their TZ), then @h for one user may be 30 minutes different than @h for another user. The same concern exists for relative day specifiers anywhere they exist (not just for the snap-to part) because where midnight falls (e.g. where the DayChange time is), may be different for different users so the window for day can be different from user-to-user.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...