I use Splunk Free License. For Free License, we cannot change the user settings. I mean, I can't change the timezone in the Splunk GUI. To change the timezone, I'm guessing i need to edit the conf file. Please tell me how to change the timezone. ... View more

We have imported Json data with the following custom_fields. { "id": 100, "custom_fields": [{ "id": 1, "name": "Date", "value": "2017-12-15" }, { "id": 2, "name": "Apply_Time", "value": 1.5 }, { "id": 3, "name": "Actual_Time", "value": 0 }], "created_on": "2017-12-15", "updated_on": "2017-12-15" } I want to make the value of custom_fields look like the table below. | id | Date | Apply_Time | Actual_Time | created_on | updated_on | | 100 | 2017-12-15 | 1.5 | 0 | 2017-12-15 | 2017-12-15 | I tried spath command etc, but I did not solve it. Thank you for your instruction. ... View more