Splunk AppDynamics

Making sense of zulu time format is 'eventTimestamp' shows '2020-09-20T11:28:30.186Z'

Basam_Nath
Explorer

Hello good folks

SELECT eventTimestamp FROM transactions WHERE application = "MyPROD" and eventTimestamp BETWEEN '2020-09-20T10:28:30.186Z' and '2020-09-20T10:28:40.186Z'

I get the data successfully, but the time is exactly 6 hours behind. What time zone or format is 2020-09-20T10:28:40.186Z

The letters 'T' and 'Z' represent the Zulu time format, but I can't understand the results. The results are exactly 6 hours behind the expected.

Labels (1)
Tags (1)
0 Karma

Hiroki_Ito
Contributor

Thank you for posting to the community.

The transaction data is stored in events service with UTC timestamp, so you need to specify UTC timestamp when searching with ADQL query.
However, the analytics page automatically converts the eventTimestamp in results to the local browser timestamp.

Depending on the timezone you are in, the eventTimeStamp in results and where query may seem to be inconsistent because of the conversion by the page.
In addition, any timezone can be explicitly selected in Display Time Zone setting of My Preferences page.

Best Regards,
Hiroki
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...