Getting Data In

Timezone and Timestamp modification at search/report time?


We have standardized our infrastructure on UTC, but we want to generate reports in PST. Is there a way to specify a timezone transform at search time such that the events themselves don’t need to be modified? the link below would change the actual messages as they come in and I want to keep the data in splunk and my various raw syslog messages consistent.

Tags (2)


The answer is as wrong now as it was 9 years ago. Epoch time exists independent of time zones, but your answer alters epoch time without consideration for what epoch time is. No sense continuing the nine years of confusion simply because no one noticed the mistake before.

0 Karma


Could you handle daylight savings time dynamically?

0 Karma


Am i missing something? PST = -7:00 of GMT, so this should be 7*60*60 = 25200. Why is it 28800?

0 Karma

Path Finder

Pacific Time (PT) is -7 OR -8 of GMT depending on Daylight Saving Time. From winter to spring it's -8 (PST), from spring to winter it's -7 (PDT).

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!