#Random
This is a place to discuss all things outside of Splunk, its products, and its use cases.

Feature Request: "normalizetouserprofiletz=t" for `fieldformat` and `convert` commands

woodcock
Esteemed Legend

This is probably a very ineffective way to make a feature request but I see that there is a tag for it, so I thought I would give it a try.

I just answered a question about dealing with non- _time timestamps (see link at the bottom) and it occurred to me that Splunk really needs an option for the fieldformat and convert (and probably other) commands to tell them to present times to the user not in GMT (which is currently the only possible behavior, and should remain the default), but rather adjusted to the TZ that is set for the user in his Search Head profile. Perhaps something like "normalizetouserprofiletz=t" (defaults to "f") would work.

http://answers.splunk.com/answers/246642/how-to-configure-splunk-to-convert-multiple-dateti.html#ans...

Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Feature request? First check and see if it is here: http://wiki.splunk.com/Community:ERs

This is a community driven Wiki page with all of our Enhancement Requests. Once you see it on/not on the list, then open a support Ticket with relevant information. If you don't see it to the ER list, please add it so others may also see what you have in mind.

== Edit 1 ==
So, the link to the question has nothing to do with non-_time timestamps. By default, events are shown in the Event View with the TZ associated to the user profile. If the TZ is not defined in the user's profile, then Splunk uses the local system TZ of the search head.

0 Karma

woodcock
Esteemed Legend

I have no idea how the wrong link got into my "question" but I have fixed the link to provide some context to my request. Eventually, I will open Support Ticket.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The best way to submit feature requests is to open a case under your support entitlement.

richgalloway
SplunkTrust
SplunkTrust

@woodcock Consider submitting this feature request at https://ideas.splunk.com/

---
If this reply helps you, Karma would be appreciated.
0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...