Splunk Search

How to specify a timezone in a datamodel

ebs
Communicator

Is there a way to specify a timezone in a datanmodel?

I have an eval field called date relying on Splunk's _time field but I want to ensure that it matches a specific timezone, rather than relying on the extracted _time of the log as its in UTC.

I want to have the timezone match Brisbane, Australia (+10)

Labels (2)
0 Karma

codebuilder
Influencer

Timezone is applied at search time based on the users' settings. If none is set for the user Splunk will use the TZ of the server (default).

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

ebs
Communicator

This doesn't help in my instance because even though my timezone is set to mine, when doing a tstats datamodel the timezone is UTC no matter my settings

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.