Splunk Search

How to specify a timezone in a datamodel

ebs
Communicator

Is there a way to specify a timezone in a datanmodel?

I have an eval field called date relying on Splunk's _time field but I want to ensure that it matches a specific timezone, rather than relying on the extracted _time of the log as its in UTC.

I want to have the timezone match Brisbane, Australia (+10)

Labels (2)
0 Karma

codebuilder
Influencer

Timezone is applied at search time based on the users' settings. If none is set for the user Splunk will use the TZ of the server (default).

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

ebs
Communicator

This doesn't help in my instance because even though my timezone is set to mine, when doing a tstats datamodel the timezone is UTC no matter my settings

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...