Thanks @PickleRick @isoutamo @ITWhisperer , the issue was that source type was not specified for this monitor, which breakdowns the events and adds the timezone IST to the events ... View more

Also,           Checked account preference for timezone, it's this  - (GMT+05:30) Chennai, Kolkata, Mumbai, New Delhi   ... View more

1) It's sending in IST  2) But I could see _time being 5hrs:30mins greater than the event timestamp, will check these forwarder parameters for that source. But currently it looks like this - [monitor:///var/log/auth/app] index = auth-signedcall _meta = stack::<stackname>   ... View more

Inside the container I get this - bash-4.2# date Mon Jun 26 12:54:44 IST 2023 ... View more

Also,           we added this part in the application code's Dockerfile  too - ENV TZ=Asia/Calcutta RUN ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime && echo ${TZ} > /etc/timezone ... View more

Could this help ? @PickleRick @ITWhisperer  ... View more

Regarding knowledge objects thanks ✌️ ... View more

Naah the answer that you posted , i shared that with the admin user and did the trick ... View more

Thanks I had checked that but that wasn't the issue had verified all this before itself ... View more

No , just one guy with admin access is able to see it. Everyone is able to see attrs.xyz but not xyz ( which I created as field alias [xyz as attrs.xyz] ) yeah application scope is set to search and also , in permissions , global sharing are set with read access to everyone  ... View more

So I have an application that runs as a docker container in AWS ECS Fargate, and in log configurations for the container , I have used splunk log driver , here I have used --log-opt env to let say set a variable xyz, this variable appears now in the logs under attrs.xyz but I don't want to search everytime using this , so I used field alias in the settings -> fields -> new filed aliases  and created xyz = attrs.xyz, but now I have created this field alias and I can't see it (use it to filter the search) but admin user can see this field although correct app - search was selected , and read permission to everyone was given. ... View more

Could someone please help here ? ... View more