That's interesting, because indeed splunk does make something strange with _time export on CSV... when it's formated by default. If I did simply | makeresults I'd get my results as When I exported the job to csv, I'd get "_time" "2021-11-19T20:49:41.000+0200" But if I started fooling around with fieldformat I started getting weird results: | makeresults | eval t=_time | fieldformat t=strftime(t,"%Y-%m-%d %H:%M:%S.%l %z") As you can see, both fields, t and _time should have the same value. And in the WebUI it does indeed seem so: But the CSV export shows... "_time",t "2021-11-19T20:52:30.000+0200","2021-11-19 20:52:30.000 +0100" So if we render the _time without the timezone information, CSV export produces the default timezone on its own anyway. But if we render the _time with a proper timezone including format... | makeresults | eval t=_time | fieldformat t=strftime(t,"%Y-%m-%d %H:%M:%S.%l %z") | fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S.%l %z") Again - t and _time are equal but this time also string representations are explicitly created with the same format, including timezone information. And now the CSV includes proper TZ information in both fields. "_time",t "2021-11-19 20:55:40.000 +0100","2021-11-19 20:55:40.000 +0100" So it seems it's not the webUI that is at fault but there's something "wrong" with CSV export.
... View more