Can you please help us in changing time from central to EST during search time? We have our server in central zone and hence we are seeing time as CST.
index=sa host=central.1 sourcetype=tidal_log "external" NOT "exec" NOT "*Process ID" | table _time,jcode, jname, jstatus | sort -_time, jstatus
The time you see is controlled by your user's settings, change that by clicking your name in the top centre.
When you search for
index=sa host=central.1 sourcetype=tidal_log | head 10 you should see the raw data, and to the left of the raw data there should be a time column. That time column should be displayed in your user's time zone, ie EDT. The raw data could be in any time zone.
Hi, I dont see any time column.
Could notice below fields available , but I dont believe these are useful to list time in EST
I have that one as US/Eastern only, but since our data center is their in CST and I am just assuming it may be reason?
Can there be any possibility to format time during search time using eval time?