Splunk doesn't really offer a means to convert time zones since each user has the ability to set their own preferred time zone. If you really want to do it, then your lookup table will need to provide the offset from the default time zone to the local country time zone.  The you should be able to pass that value to the relative_time function. ... View more

No, you do not need any Splunk software for Splunk training or exams.  Training courses will provide any necessary software and exams require no Splunk software.  Experience with Splunk software is helpful, but not required. ... View more

It would help to know what you've tried already so we don't suggest something that doesn't work. A thing to remember is Splunk can't compare timestamps in text form - they must be converted to epoch (integer) form, first. | makeresults format=csv data="Employee, Time, Country John Doe, 2023-11-15T20:05:31.000+00:00, France John Doe, 2023-11-18T10:00:31.000+00:00, France John Doe, 2023-11-20T10:05:31.000+00:00, United States John Doe, 2023-11-25T20:05:31.000+00:00, United States" ``` Above creates demo data. Delete IRL ``` ``` Convert Time to epoch ``` | eval eTime=strptime(Time, "%Y-%m-%dT%H:%M:%S.%3N%:z") ``` Find the lowest and highest time for each employee/country pair ``` | stats min(eTime) as start, max(eTime) as end by Employee,Country ``` Calculate the duration in days. Add "d" suffix for display ``` | eval duration=round((end-start)/86400,0) . "d" | table Employee duration Country ... View more