How to specify a timezone in a datamodel

ebs · ‎07-22-2021

Is there a way to specify a timezone in a datanmodel?

I have an eval field called date relying on Splunk's _time field but I want to ensure that it matches a specific timezone, rather than relying on the extracted _time of the log as its in UTC.

I want to have the timezone match Brisbane, Australia (+10)

codebuilder · ‎07-27-2021

Timezone is applied at search time based on the users' settings. If none is set for the user Splunk will use the TZ of the server (default).

----
An upvote would be appreciated and Accept Solution if it helps!

ebs · ‎07-27-2021

This doesn't help in my instance because even though my timezone is set to mine, when doing a tstats datamodel the timezone is UTC no matter my settings

How to specify a timezone in a datamodel

eval

fields

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Are you a member of the Splunk Community?

How to specify a timezone in a datamodel

eval

fields

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever