Getting Data In

Real Time Search On Dashboard Time Zone

edenael20
New Member

I have a dashboard that has 2 real time search counts and all the other panels are based on scheduled searches. The real time counts events on last 5 minutes. On the upper corner of each panel it displays the last time the search has been ran. It will say refreshed at hh:mm. The scheduled searches have the correct eastern time which is the time of the server and the logs. The real time search however is displaying my time zone (central time). Does that timestamp reflect the timezone of the browser or this being set somewhere?

Tags (3)
0 Karma

woodcock
Esteemed Legend

There is a user/login-level setting that tells Splunk how to normalize timestamps when presenting data to each user. It is in Settings -> Edit Account -> Times zone. This normalized time is shown only if you select List or Table (e.g. not Raw) in the upper-left corner above the search results. Doing so creates a Time column next to the Event column. Do you see this?

0 Karma

woodcock
Esteemed Legend

Did this help?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...