most of my data sets to UTC, and all data sources are properly tagged to convert to UTC if they are not.
My user is in PST, so when I run a search such as @d etc, it starts from midnight PST. Usually this is ok, as dashboards are built with this in mind.
I have an extra use case for monitoring our splunk license usage, Splunk however runs it's license metrics based on 0-24:00 UTC. Any search I run for "last day" is going to be off by 1/3 based on this time difference.
Is there a way to set a specific search to ignore the associated users search head timezone setting and run in UTC (or other specification) on that search?
The following will convert from the timezone of your user account to UTC. You could use it in a subsearch to set earliest/latest in your search.
| makeresults
| eval myTime=_time
| eval showMyTime=strftime(myTime,"%H:%M")
| eval myZone=strftime(myTime,"%z")
| eval UTC=myTime-((myZone/100) *3600)
| eval showUTC=strftime(UTC,"%H:%M")
Try something like in your searches to specify time range
your base search [| gentimes start=-1 | eval UTCOffset=strptime(strftime(now(),"%m/%d/%Y %H:%M:%S")." UTC","%m/%d/%Y %H:%M:%S %Z") - now() | addinfo | eval earliest=info_min_time+UTCOffset | eval latest=info_max_time+UTCOffset | table earliest latest | format "" "" "" "" "' ""] | rest of the search