Splunk Search
Highlighted

How do you get a timechart to display local time in Visualization?

Engager

I have the following query:

host=PRODPLEX  NOT "C:\\WINDOWS\\system32"
| timechart span=1m sum(deltatasks)

The Events for the query show the local time, the visualization shows UTC time.

How do I get a timechart to display local time in Visualization?

0 Karma
Highlighted

Re: How do you get a timechart to display local time in Visualization?

Motivator

Which visualization are you using?

Perhaps you need to set the correct time zone for your user:
Click on your username at the top and then click on Preferences.

View solution in original post

Highlighted

Re: How do you get a timechart to display local time in Visualization?

Engager

I am using a line chart for visualization.
My user was using the default time zone.
The time displayed correctly once I corrected the timezone as per your instructions.
Thanks for your help.

0 Karma
Highlighted

Re: How do you get a timechart to display local time in Visualization?

SplunkTrust
SplunkTrust

@tonyclifford Did you ever solve this problem?

I am actually seeing the opposite problem: sometimes stats by _time on a summary data displays the x-axis in local time. I want UTC time.

0 Karma