Splunk Search

Configure an emailed report with timechart to display in local time rather than GMT?


I have a report of proxy logs that is emailed to me every evening. The logs themselves are in GMT. I set the time frame for Today.

When I view the report in my browser, the timechart shows from 00:00 - 24:00 (next day) since my account setting is set to display using my local time. However, the report I receive via email has the timechart start from 05:00 - 05:00 (next day). The report also includes a table below the chart but that shows up fine. People who aren't used to reading GMT have a hard time translating the timechart time to local in their heads.

How can I edit my search query to have the emailed report show the timechart with hours based on my local time? I would accept a hardcoded method that doesn't account for daylight savings if that makes things easier. Then I only have to adjust the report twice a year.

Web view of report (working how I want)
alt text

Emailed PDF of report (not how I want)
alt text

I tried using the solution posted here but none seemed to work for me (in displaying both the graph and table correctly).

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...