Splunk Search

Ignore time zone in searches

echalex
Builder

Hi, is there a way of ignoring the time zone in the searches? Currently, Splunk will reinterpret the difference in time zones. Because of daylight savings time, Splunk will offset the results by one hour from the actual timestamp. So, I would like to know what actually happened at say 11:23 and not 11:23 minus an hour.

Tags (2)
1 Solution

Drainy
Champion

At the moment the best way to do this is for the user to adjust their timezone settings to match the server Or the time they are investigating. Otherwise just making the adjustments when they search 🙂

You could submit an enhancement request for this at https://www.splunk.com/page/submit_issue

It may be something that is included, really I would say that its just a matter of user training, or ensuring that your infrastructure operates on UTC to make life even easier!

View solution in original post

landen99_gdms
Explorer

The following macro formats the time to a standard utc timezone:

[utc]

definition = eval time_offset=strftime(_time,"%:::z") | convert num(time_offset) | eval time_offset=if(time_offset<=0, "+" . -time_offset, tostring(-time_offset)), time_utc=relative_time(_time,time_offset . "h") | convert timeformat="%F %T UTC" ctime(time_utc) | convert `timeformat` ctime(_time) AS time_local

The following macro sets the time to the timezone of your choice:

[tz(1)]

definition = eval utc_offset=strftime(_time,"%:::z") | convert num(utc_offset) | eval tz_offset = $tz$ - utc_offset, tz_offset = if(tz_offset>=0,"+".tz_offset,tz_offset), utc_offset = if(utc_offset<=0,"+".-utc_offset,tostring(-utc_offset)) | eval time_tz=relative_time(_time, tz_offset . "h"), utc_time=relative_time(_time,utc_offset . "h") | convert timeformat="%F %T UTC" ctime(utc_time) | convert timeformat="%F %T UTC$tz$" ctime(time_tz) | convert `timeformat` ctime(_time) AS my_time | fields - tz_offset utc_offset* | rename time_tz AS "time:$tz$"

args = tz

[timeformat]

definition = timeformat="%F %T UTC%:::z %Z"
0 Karma

Drainy
Champion

At the moment the best way to do this is for the user to adjust their timezone settings to match the server Or the time they are investigating. Otherwise just making the adjustments when they search 🙂

You could submit an enhancement request for this at https://www.splunk.com/page/submit_issue

It may be something that is included, really I would say that its just a matter of user training, or ensuring that your infrastructure operates on UTC to make life even easier!

echalex
Builder

Thanks, Drainy!

I don't think user training is going to be that effective, and switching timezones is only going to help if I can switch to a zone which is identical, but without DST.
Changing to UTC is not an option, so I hope an enhancement request might help.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...