Splunk Search

How to show same data for different timezones in single timechart ?

sangs8788
Communicator

I have a panel which shows the usage of a dashboard in GMT timezone. Is it possible to show the same data in different timezones (PST, EST, IST, etc) as different lines in same chart?

Below is the query which shows count in GMT timezones 

index="_internal" user!="-" sourcetype=splunkd_ui_access "GET" "sample"
| rex field=uri "\/app\/(?<App_Value>\w+)\/(?<dashboard>[^?\/]+)"
| search App_Value="sample" dashboard = "daily_health"
|timechart count 

How can we modify this query to show in different timezone in single chart?

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Your question boils down to the often posted one - "can we display data in another timezone". The general answer is "no". The timestamp itself is stored by Splunk as number of seconds since epoch (Jan 1st 1970) and is rendered in the UI according to user's timezone settings. And short of modifying the actual timestamp and "cheating" this way there's no way to display a timestamp's represenation in different timezone.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you have extracted the timezone into a field (tz), you could add it as a by clause to the timechart

| timechart count by tz

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...