Splunk ITSI

Different time displayed(ITSI threshold for time policy)

satokoji
Explorer

Hi

I'm using ITSI ver 3.1.4.
In ”threshold for time policy" page, displayed time of time policy selector and "View data to ..." are diffrent.
User time zone is (GMT+09:00) , and the difference of time is just 9h (ref. attached image),
so one is standard time and the other is user time zone.

Is it possible to display only user time zone?

Thanks.

alt text

curtismcginity
Explorer

So I solved this problem by applying a time zone offset using kvstore_to_json.py operations. The documentation very clearly details how to make this work.

Just remember to enter your time offset in SECONDS, as I missed this the first time around 🙂

Edit: Link doesn't seem to appear, so adding here: http://docs.splunk.com/Documentation/ITSI/4.1.2/Configure/kvstore_to_json.pyoperations#Apply_time_zo...

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...