Epoch/Unix times are always in UTC. When I use convert to create a human readable time, the timezone ( %Z ) is somehow incorrect for some sourcetypes but correct for others. I realize the timezone on those sourcetypes may be incorrect, but then the epoch time should reflect that. example <base search> | stats latest(_time) as latest_epoch earliest(_time) as earliest_epoch by sourcetype | convert timeformat="%x %X %Z" ctime(latest_epoch) AS latest_human | convert timeformat="%x %X %Z" ctime(earliest_epoch) AS earliest_human This results in sourcetype latest_epoch earliest_epoch earliest_human latest_human 1 sourcetypeA 1553733248.762 1553718850.771 03/27/19 14:34:10 MDT 03/27/19 18:34:08 MDT 2 sourcetypeB 1553733250 1553733250 03/27/19 18:34:10 MDT 03/27/19 18:34:10 MDT 3 sourcetypeC 1553733253 1553733253 03/27/19 18:34:13 MDT 03/27/19 18:34:13 MDT 4 sourcetypeD 1553733250 1553718190.756 03/27/19 14:23:10 MDT 03/27/19 18:34:10 MDT 5 sourcetypeE 1553733250 1553733250 03/27/19 18:34:10 MDT 03/27/19 18:34:10 MDT As you can see rows 2,3 & 5 are correct. Rows 1 and 4 are not. However all rows have essentially the same epoch time. Epoch time is always in GMT, so why is it being converted to two different timezones yet also claiming to be MDT. What gives? ... View more

I have many different but simultaneous metrics that I am graphing over time. The y axis for each have different ranges. (0 to a million or 30% to 70% or whatever) but the time (x axis) is concurrent for all. I want to put these charts in a dashboard, vertically stacked, and have the timescales for each match up exactly. Some things I have tried that don't quite work: Multi-series mode: This forces me to choose one chart format for each, but I need some to be lines, some to be bar charts, and some to be bubble charts. Chart overlay: This is fine for two series, but I have many. Creating one big table and then just field - away the ones I don't care about about for each panel. This is tedious and I have not gotten consistent results. Also, the search for the report becomes complex as I have multiple indexes, sources and sourcetypes for each time series. Ideally each search could run independent but share a single timescale for the entire dashboard. I have seen tools like Grafana do this easily. I don't need the shared crosshair like Grafana does, but I do need a shared timescale. Surely there is a way to do this with Splunk and I am just ignorant. Please help! Thanks ... View more