Splunk Search

Event count bucket starts from 2 AM (indipendent of earliest and latest)

New Member

Dear All,

I'm doing a search as the following:

sourcetype="sophos" pmx_action="keep" fur!="none"| bucket span=24h _time | timechart span=24h count

I'd like to count the event on 24H basis. Indipendent of the earliest and latest time that I set, I receive a timechart with a count of events that start from 2 AM of the day to the 2 AM of the following.

Anyone has idea of what is the problem?


Tags (1)
0 Karma

Path Finder

Note that timechart can do bucketing, so the "| bucket" call you have is redundant. Have you tried it without?

Could time zone issues be in play? For example, is the search head in one time zone, but the indexer in another?

Path Finder

If you run a search in the search bar, the "date_zone" field will contain the time zone of the events. Typically, a small Splunk installation will be for just a single site (rather than multiple offices in different cities), so the time zone will be listed as 'local'--the time zone of the indexer system itself.

There was a bug in versions earlier than 4.1.3 about time zones; it wasn't being applied to the flash charts. The release notes are here:

New Member

Thank you smisplunk.

How can I check search and indexer timezone?

Thank you

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!