Splunk Search

How to show same data for different timezones in single timechart ?

sangs8788
Communicator

I have a panel which shows the usage of a dashboard in GMT timezone. Is it possible to show the same data in different timezones (PST, EST, IST, etc) as different lines in same chart?

Below is the query which shows count in GMT timezones 

index="_internal" user!="-" sourcetype=splunkd_ui_access "GET" "sample"
| rex field=uri "\/app\/(?<App_Value>\w+)\/(?<dashboard>[^?\/]+)"
| search App_Value="sample" dashboard = "daily_health"
|timechart count 

How can we modify this query to show in different timezone in single chart?

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Your question boils down to the often posted one - "can we display data in another timezone". The general answer is "no". The timestamp itself is stored by Splunk as number of seconds since epoch (Jan 1st 1970) and is rendered in the UI according to user's timezone settings. And short of modifying the actual timestamp and "cheating" this way there's no way to display a timestamp's represenation in different timezone.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you have extracted the timezone into a field (tz), you could add it as a by clause to the timechart

| timechart count by tz

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...