Splunk AppDynamics

Making sense of zulu time format is 'eventTimestamp' shows '2020-09-20T11:28:30.186Z'

Basam_Nath
Explorer

Hello good folks

SELECT eventTimestamp FROM transactions WHERE application = "MyPROD" and eventTimestamp BETWEEN '2020-09-20T10:28:30.186Z' and '2020-09-20T10:28:40.186Z'

I get the data successfully, but the time is exactly 6 hours behind. What time zone or format is 2020-09-20T10:28:40.186Z

The letters 'T' and 'Z' represent the Zulu time format, but I can't understand the results. The results are exactly 6 hours behind the expected.

Labels (1)
Tags (1)
0 Karma

Hiroki_Ito
Contributor

Thank you for posting to the community.

The transaction data is stored in events service with UTC timestamp, so you need to specify UTC timestamp when searching with ADQL query.
However, the analytics page automatically converts the eventTimestamp in results to the local browser timestamp.

Depending on the timezone you are in, the eventTimeStamp in results and where query may seem to be inconsistent because of the conversion by the page.
In addition, any timezone can be explicitly selected in Display Time Zone setting of My Preferences page.

Best Regards,
Hiroki
0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...