Splunk Search

How to show same data for different timezones in single timechart ?

sangs8788
Communicator

I have a panel which shows the usage of a dashboard in GMT timezone. Is it possible to show the same data in different timezones (PST, EST, IST, etc) as different lines in same chart?

Below is the query which shows count in GMT timezones 

index="_internal" user!="-" sourcetype=splunkd_ui_access "GET" "sample"
| rex field=uri "\/app\/(?<App_Value>\w+)\/(?<dashboard>[^?\/]+)"
| search App_Value="sample" dashboard = "daily_health"
|timechart count 

How can we modify this query to show in different timezone in single chart?

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Your question boils down to the often posted one - "can we display data in another timezone". The general answer is "no". The timestamp itself is stored by Splunk as number of seconds since epoch (Jan 1st 1970) and is rendered in the UI according to user's timezone settings. And short of modifying the actual timestamp and "cheating" this way there's no way to display a timestamp's represenation in different timezone.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you have extracted the timezone into a field (tz), you could add it as a by clause to the timechart

| timechart count by tz

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...