Splunk renders the times in user's configured timezone. I don't think there's a way to override it. As I said, you could do some magic with either recalculating timestamps (which would be bad - you should never touch timestamps unless you really mean it) or doing some nasty tricks with fieldformat (which would be ugly and would need to be explicitely called in every search). I understand that there could be some borderline use cases with geographically spread teams working together but they would still have many more problems than just timestamps in splunk so they should already have it figured out without the need to force a particular timezone on the user. ... View more

Sorry, it doesnt. I dont get any results. ... View more

Yes.  The columns have to exist before addcoltotals can add them. ... View more