Splunk AppDynamics

Making sense of zulu time format is 'eventTimestamp' shows '2020-09-20T11:28:30.186Z'

Basam_Nath
Explorer

Hello good folks

SELECT eventTimestamp FROM transactions WHERE application = "MyPROD" and eventTimestamp BETWEEN '2020-09-20T10:28:30.186Z' and '2020-09-20T10:28:40.186Z'

I get the data successfully, but the time is exactly 6 hours behind. What time zone or format is 2020-09-20T10:28:40.186Z

The letters 'T' and 'Z' represent the Zulu time format, but I can't understand the results. The results are exactly 6 hours behind the expected.

Labels (1)
Tags (1)
0 Karma

Hiroki_Ito
Contributor

Thank you for posting to the community.

The transaction data is stored in events service with UTC timestamp, so you need to specify UTC timestamp when searching with ADQL query.
However, the analytics page automatically converts the eventTimestamp in results to the local browser timestamp.

Depending on the timezone you are in, the eventTimeStamp in results and where query may seem to be inconsistent because of the conversion by the page.
In addition, any timezone can be explicitly selected in Display Time Zone setting of My Preferences page.

Best Regards,
Hiroki
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...