Splunk Search

How to specify a timezone in a datamodel

ebs
Communicator

Is there a way to specify a timezone in a datanmodel?

I have an eval field called date relying on Splunk's _time field but I want to ensure that it matches a specific timezone, rather than relying on the extracted _time of the log as its in UTC.

I want to have the timezone match Brisbane, Australia (+10)

Labels (2)
0 Karma

codebuilder
Influencer

Timezone is applied at search time based on the users' settings. If none is set for the user Splunk will use the TZ of the server (default).

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

ebs
Communicator

This doesn't help in my instance because even though my timezone is set to mine, when doing a tstats datamodel the timezone is UTC no matter my settings

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...