set timezone in search

[GeorgeStarkey]

most of my data sets to UTC, and all data sources are properly tagged to convert to UTC if they are not.

My user is in PST, so when I run a search such as @d etc, it starts from midnight PST. Usually this is ok, as dashboards are built with this in mind.

I have an extra use case for monitoring our splunk license usage, Splunk however runs it's license metrics based on 0-24:00 UTC. Any search I run for "last day" is going to be off by 1/3 based on this time difference.

Is there a way to set a specific search to ignore the associated users search head timezone setting and run in UTC (or other specification) on that search?

[rrice_splunk]

The following will convert from the timezone of your user account to UTC. You could use it in a subsearch to set earliest/latest in your search.

| makeresults
| eval myTime=_time
| eval showMyTime=strftime(myTime,"%H:%M")
| eval myZone=strftime(myTime,"%z")
| eval UTC=myTime-((myZone/100) *3600)
| eval showUTC=strftime(UTC,"%H:%M")

[somesoni2]

Try something like in your searches to specify time range

your base search [| gentimes start=-1  | eval UTCOffset=strptime(strftime(now(),"%m/%d/%Y %H:%M:%S")." UTC","%m/%d/%Y %H:%M:%S %Z") - now() | addinfo  | eval earliest=info_min_time+UTCOffset | eval latest=info_max_time+UTCOffset | table earliest latest | format "" "" "" "" "' ""] | rest of the search