Different time displayed(ITSI threshold for time policy)

[satokoji]

Hi

I'm using ITSI ver 3.1.4.
In ”threshold for time policy" page, displayed time of time policy selector and "View data to ..." are diffrent.
User time zone is (GMT+09:00) , and the difference of time is just 9h (ref. attached image),
so one is standard time and the other is user time zone.

Is it possible to display only user time zone?

Thanks.

[curtismcginity]

So I solved this problem by applying a time zone offset using kvstore_to_json.py operations. The documentation very clearly details how to make this work.

Just remember to enter your time offset in SECONDS, as I missed this the first time around 🙂

Edit: Link doesn't seem to appear, so adding here: http://docs.splunk.com/Documentation/ITSI/4.1.2/Configure/kvstore_to_json.pyoperations#Apply_time_zo...