When bucket time is between 03/08/2018 00:00:00 and 03/08/2018 24:00:00 with JST (GMT+9) as timezone, the starting time of search doesn’t match the local timezone.
Example)
index=xxx | timechart count span=12h
Expected result:
Starting time should be 03/08/2018 00:00:00 and then, +12h would be
03/08/2018 12:00:00.
Actual result:
Starting time gets 03/07/2018 15:00:00 and then, +12h would be
03/08/2018 03:00:00.
Could you tell me why?
Span option is always rounding down the starting date (first bin) in a specific way by design.
Thus, there is no guarantee that start time bin used by timechart is corresponding to local timezone.
Even bucket time is between 03/08/2018 00:00:00 and 03/08/2018 24:00:00 based on certain timezone,
the start time of search doesn’t always match the same.
Workaround might be as below.
index=* | eval day=strftime(_time, "%u.%A")
| bucket date_hour span=12
| chart count by date_hour day
Enhancement request related with spap and timezone is below.
SPL-148967 Align the start of the first time bucket to the start time of a search.
Span option is always rounding down the starting date (first bin) in a specific way by design.
Thus, there is no guarantee that start time bin used by timechart is corresponding to local timezone.
Even bucket time is between 03/08/2018 00:00:00 and 03/08/2018 24:00:00 based on certain timezone,
the start time of search doesn’t always match the same.
Workaround might be as below.
index=* | eval day=strftime(_time, "%u.%A")
| bucket date_hour span=12
| chart count by date_hour day
Enhancement request related with spap and timezone is below.
SPL-148967 Align the start of the first time bucket to the start time of a search.