Event count bucket starts from 2 AM (indipendent of earliest and latest)

[fedevietti]

Dear All,

I'm doing a search as the following:

sourcetype="sophos" pmx_action="keep" fur!="none"| bucket span=24h _time | timechart span=24h count

I'd like to count the event on 24H basis. Indipendent of the earliest and latest time that I set, I receive a timechart with a count of events that start from 2 AM of the day to the 2 AM of the following.

Anyone has idea of what is the problem?

Regards

[smisplunk]

Note that timechart can do bucketing, so the "| bucket" call you have is redundant. Have you tried it without?

Could time zone issues be in play? For example, is the search head in one time zone, but the indexer in another?

[smisplunk]

If you run a search in the search bar, the "date_zone" field will contain the time zone of the events. Typically, a small Splunk installation will be for just a single site (rather than multiple offices in different cities), so the time zone will be listed as 'local'--the time zone of the indexer system itself.

There was a bug in versions earlier than 4.1.3 about time zones; it wasn't being applied to the flash charts. The release notes are here:
http://www.splunk.com/base/Documentation/latest/ReleaseNotes/4.1.3

[fedevietti]

Thank you smisplunk.

How can I check search and indexer timezone?

Thank you