Splunk Search

Configure an emailed report with timechart to display in local time rather than GMT?

DEAD_BEEF
Builder

I have a report of proxy logs that is emailed to me every evening. The logs themselves are in GMT. I set the time frame for Today.

When I view the report in my browser, the timechart shows from 00:00 - 24:00 (next day) since my account setting is set to display using my local time. However, the report I receive via email has the timechart start from 05:00 - 05:00 (next day). The report also includes a table below the chart but that shows up fine. People who aren't used to reading GMT have a hard time translating the timechart time to local in their heads.

How can I edit my search query to have the emailed report show the timechart with hours based on my local time? I would accept a hardcoded method that doesn't account for daylight savings if that makes things easier. Then I only have to adjust the report twice a year.

Web view of report (working how I want)
alt text

Emailed PDF of report (not how I want)
alt text

I tried using the solution posted here but none seemed to work for me (in displaying both the graph and table correctly).

0 Karma
Get Updates on the Splunk Community!

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...