splunk search

[trojan_81]

Hi

Suppose the device that sent the log to Splunk is logging in US Pacific time. If I run a search like this in splunk:

sourcetype=blah Data="*blahdata*" | table _time, Action, Data, Username

In reviewing the output of the search,

Is _time in US Pacific or the default UTC?  

[isoutamo · Accepted solution]

When you are defining input correctly to recognize time zone then it has stored as GMT time and then you could see it as your current time zone has defined on your personal setting.
r. Ismo