Splunk Search

How to fix timechart issue with dates involved in between a daylight savings time change?

csepulveda
New Member

Hi guys, we have a problem when we try to use timecharts that involve dates having in between a daylight saving time change.

If I change my timezone to GMT in account preferences, the timecharts query works fine, but if I do a span=1d it shows September 6 twice and doesn't show September 7.

If i change my timezone to GMT-4 Santiago, the query fails showing NaN numbers.

The query is

: sourcetype=varnish
account_id="50aa2711a6884125020019f1"
| timechart span=1d
distinct_count(customer_id)

All our logs has time fields on UTC.

any ideas?

Thanks!.

Tags (3)
0 Karma

aweitzman
Motivator

You might be running into this problem:

http://answers.splunk.com/answers/155320/why-is-the-search-app-time-range-picker-defaulting-to-2001-...

There's something magic about September 6, based on the comments in that thread.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...