Splunk AppDynamics

Making sense of zulu time format is 'eventTimestamp' shows '2020-09-20T11:28:30.186Z'

Basam_Nath
Explorer

Hello good folks

SELECT eventTimestamp FROM transactions WHERE application = "MyPROD" and eventTimestamp BETWEEN '2020-09-20T10:28:30.186Z' and '2020-09-20T10:28:40.186Z'

I get the data successfully, but the time is exactly 6 hours behind. What time zone or format is 2020-09-20T10:28:40.186Z

The letters 'T' and 'Z' represent the Zulu time format, but I can't understand the results. The results are exactly 6 hours behind the expected.

Labels (1)
Tags (1)
0 Karma

Hiroki_Ito
Contributor

Thank you for posting to the community.

The transaction data is stored in events service with UTC timestamp, so you need to specify UTC timestamp when searching with ADQL query.
However, the analytics page automatically converts the eventTimestamp in results to the local browser timestamp.

Depending on the timezone you are in, the eventTimeStamp in results and where query may seem to be inconsistent because of the conversion by the page.
In addition, any timezone can be explicitly selected in Display Time Zone setting of My Preferences page.

Best Regards,
Hiroki
0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...