- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

bohanlon_splunk

Splunk Employee
01-20-2016
01:21 AM
In Enterprise Security, the Threat Intelligence Audit dashboard is not displaying properly.
The _time and run_duration fields are incorrectly displayed when the user is in +GMT.
This is due to the strptime()
conversion in the dashboard's search which looks like this:
eval _time=strptime('row 1', "%Y-%m-%d%T%H:%M:%S-%z")
This will work only for -GMT (-%z), but will not work for any user in +GMT.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

bohanlon_splunk

Splunk Employee
01-20-2016
01:24 AM
Answering my own question.
This is seen in ES 3.3.0 and 4.0.1.
Bug logged as SOLNESS-8361.
Workaround is remove the extra -
i.e.
eval _time=strptime('row 1', "%Y-%m-%d%T%H:%M:%S%z")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

bohanlon_splunk

Splunk Employee
01-20-2016
01:24 AM
Answering my own question.
This is seen in ES 3.3.0 and 4.0.1.
Bug logged as SOLNESS-8361.
Workaround is remove the extra -
i.e.
eval _time=strptime('row 1', "%Y-%m-%d%T%H:%M:%S%z")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

dirkmeeuwsen
Explorer
01-21-2016
05:27 AM
thanks for adding the solution!
