Incorrect Time Range for @d

[mchandx]

I have a graph that displays the license usage for the day. I have the time parameter say to "@d" because I only want to see for the current day.

The problem I am having is that the counter resets at 12:00AM GMT-1. I am in GMT-5, so the counter resets at 8:00PM local time. I want the counter to reset at 12:00AM GMT-5 or 5:00AM GMT.

Here is a copy of my search:

index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalMB = round(kb/1024, 2) | chart sum(totalMB) as total

Time is set to rt@d to rt

[mchandx · Accepted solution]

I have resolved this issue. It had nothing to do with Splunk, but rather a feature of the environment it is in.

[Drainy]

I believe you can fix this by going to Manager -> Your account and then selecting your timezone

[mchandx]

I'll give this a try. Unfortunately, there is no way to know until midnight. I will also try to specify the time perameter as "rt@d-4h" and see if that helps. I'll post back tomorrow with my results.

[Drainy]

I believe it should also affect your time ranges within searches.

[mchandx]

This seems to only change the display. Does this also change the way the application works?