How to show same data for different timezones in single timechart ?

[sangs8788]

I have a panel which shows the usage of a dashboard in GMT timezone. Is it possible to show the same data in different timezones (PST, EST, IST, etc) as different lines in same chart?

Below is the query which shows count in GMT timezones 

index="_internal" user!="-" sourcetype=splunkd_ui_access "GET" "sample"
| rex field=uri "\/app\/(?<App_Value>\w+)\/(?<dashboard>[^?\/]+)"
| search App_Value="sample" dashboard = "daily_health"
|timechart count 

How can we modify this query to show in different timezone in single chart?

[PickleRick]

Your question boils down to the often posted one - "can we display data in another timezone". The general answer is "no". The timestamp itself is stored by Splunk as number of seconds since epoch (Jan 1st 1970) and is rendered in the UI according to user's timezone settings. And short of modifying the actual timestamp and "cheating" this way there's no way to display a timestamp's represenation in different timezone.

[ITWhisperer]

Assuming you have extracted the timezone into a field (tz), you could add it as a by clause to the timechart

| timechart count by tz