Splunk Search

Timezone query to modify _time field if the user's timezone is not UTC.

waltz
Explorer

I have a dropdown in my dashboard where I provide static label and value for 4 timezones as of now(UTC,ET,PST,CT) (Which maybe increased in future). Now, Upon choosing a timezone value from the dropdown, I will have to adjust _time in a search query(of a panel/input in my dashboard) like this--> "mysearch" | eval _time = _time (+ or - ) (x*60*60) | "rest of mysearch" (If I'm right, this approach is correct if the current user's timezone is set to UTC). But, the currently logged in user's timezone maybe any among UTC,ET,PST,CT. So, I will be overriding the timezone configured in the settings. How can I modify my search query for _time field dynamically taking into account the user's current timezone and considering daylight savings time for the above mentioned timezones as well ?

0 Karma

cmerriman
Super Champion

if you do some evaluating, you should be able to put it all into UTC first.

|convert ctime(_time) as date timeformat="%Y-%m-%d"|eval _time=strptime(date,"%Y-%m-%d")
0 Karma

waltz
Explorer

I understand the approach you're suggesting @cmerriman, but I'm afraid this query does not exactly satisfy my requirement. Also, Thanks for the answer.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...