Splunk Search
Highlighted

Can you specify timezone in a REST API search?

Builder

I'm using the REST API with a one-shot search to pull back some previously summarized information. The summary indexing was done with EST timezone so the events show up as 00:00:00 EST. The server i'm doing the REST API call from is on CST timezone. When I get the results back from the search they show up as the previous day because the timestamp ends up being 1 hour before at 23:00:00 CST - 1Day. This is completely screwing up my search results. Is there a way to force the API call to use EST timezone instead of the system default?

Note:
Changing the timezone on my server is not an option because it's a shared server.

Highlighted

Re: Can you specify timezone in a REST API search?

Esteemed Legend

Change the Time zone setting ( My UserName -> Edit Account -> Time zone ) for the user running the search (REST API call) and set it to EST.

View solution in original post

Highlighted

Re: Can you specify timezone in a REST API search?

Builder

I tried this and it first it didn't work. I waited some more time though then restarted my webserver and cleared cache on my client and now its working. Thank you!

0 Karma
Highlighted

Re: Can you specify timezone in a REST API search?

Explorer

Can you elaborate what do you mean by clearing cache on the client?
I have the same problem, but not able to make it work with the same solution.

0 Karma
Highlighted

Re: Can you specify timezone in a REST API search?

New Member

You can have Splunk server return UTC time
'original query' | eval time=_time | fields - _time

0 Karma