Splunk AppDynamics

Making sense of zulu time format is 'eventTimestamp' shows '2020-09-20T11:28:30.186Z'

Basam_Nath
Explorer

Hello good folks

SELECT eventTimestamp FROM transactions WHERE application = "MyPROD" and eventTimestamp BETWEEN '2020-09-20T10:28:30.186Z' and '2020-09-20T10:28:40.186Z'

I get the data successfully, but the time is exactly 6 hours behind. What time zone or format is 2020-09-20T10:28:40.186Z

The letters 'T' and 'Z' represent the Zulu time format, but I can't understand the results. The results are exactly 6 hours behind the expected.

Labels (1)
Tags (1)
0 Karma

Hiroki_Ito
Contributor

Thank you for posting to the community.

The transaction data is stored in events service with UTC timestamp, so you need to specify UTC timestamp when searching with ADQL query.
However, the analytics page automatically converts the eventTimestamp in results to the local browser timestamp.

Depending on the timezone you are in, the eventTimeStamp in results and where query may seem to be inconsistent because of the conversion by the page.
In addition, any timezone can be explicitly selected in Display Time Zone setting of My Preferences page.

Best Regards,
Hiroki
0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...