Splunk Search

What does "yesterday" mean when data is spanning multiple timezones?

Splunk Employee
Splunk Employee

What is the expected outcome of the "Yesterday" time function when applied to data from multiple timezones. I have a report that brings data back from Berlin, Sydney and Cleveland. I would like to run the report once per day for "Yesterday's" data, but each region will have a slightly different definition of "Yesterday" based on the local timezone.

1 Solution

Splunk Employee
Splunk Employee

The "yesterday" time span is always with respect to the timezone on the search head. You can achieve your goal by setting up a separate search head per timezone, and search only the relevant data on each search head.

View solution in original post

Splunk Employee
Splunk Employee

The "yesterday" time span is always with respect to the timezone on the search head. You can achieve your goal by setting up a separate search head per timezone, and search only the relevant data on each search head.

View solution in original post

Path Finder

And how to do this?

0 Karma