Splunk Search

Query for different timezones

alucaferro
Engager

I have imported data with daytime in GMT time zone.

I need count events group by on variable interval (day,week or month) . I use a search query like this:

<mysearch>|
bucket _time span=1d | stats count as newUsersForPerido by _time

And this return counts over every day on GMT timezone.

Now I need to use this query in different time zones for example UTC+03:00 and UTC-04:00 how I can modify my search string?

0 Karma
1 Solution

woodcock
Esteemed Legend

The easiest way is just to adjust _time like this:

... | eval _time = _time + (3*60*60) | bucket _time span=1d | stats count as newUsersForPerido by _time

Be sure to also adjust your timepicker to be 3 hours earlier on both sides so you pull in the correct events.

View solution in original post

woodcock
Esteemed Legend

Also, you can adjust your user settings at Your User Name -> Edit account -> Time zone to put in different values. This setting controls the normalization of the timepicker when you pick settings that are date-relative (e.g. Today, Last 7 days, etc.).

0 Karma

woodcock
Esteemed Legend

The easiest way is just to adjust _time like this:

... | eval _time = _time + (3*60*60) | bucket _time span=1d | stats count as newUsersForPerido by _time

Be sure to also adjust your timepicker to be 3 hours earlier on both sides so you pull in the correct events.

sundareshr
Legend

In which timezone are the events generated? Are they all GMT?

http://docs.splunk.com/Documentation/Splunk/latest/data/Applytimezoneoffsetstotimestamps

0 Karma

alucaferro
Engager

Yes all events are generetad in GMT

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...