Display user specific timezone in Dasboard

[basilarockiaedw]

I changed the user specific timezone through the Manager > Your Account management pane.
Now I got a requirement to display user chosen timezone in the dashboard he/she is viewing.
do we have any such values in splunk which holds the user specific configuration info?

Thanks,
Basil

[chuckers]

I have a solution that works beautifully to display the user's selected time zone on a dashboard. I typically display it in the label for the time picker and the X axis labels of all timeline visualizations.

Step 1. Make a hidden single value panel that pulls one event (usually just looking back one second is enough).
Step 2. From that one event, first I get the _time field (which HAS been offset by the user's TZ preference selection).
Step 3. Then I do your own extraction of the timestamp from the _raw event (with a rex command) this time has NOT been shifted.
Step 4. Then I subtract those two times to see how far from GMT they the user has shifted their data.

Step 5. I then use a case statement in eval to convert the time offset to a user friendly string. For example, a -8 hour shift from GMT might get converted to something like "Pacific time (GMT -8h)"
Step 6. Display the desired timezone string in the (hidden) single value panel.

Step 7. I add some XML to save the value in the panel to a token.
Step 8. Use that token where ever you desire to display the user's selected time zone.

Beware of the fact that in some places you have two possibilities for any given offset (Daylight savings time and standard time). I usually account for that in my case statement (Step 5) by rather crudely assuming that Nov-Feb are Daylight Savings time and the other months are not. (This works for my location but might need to be tweaked for your location.

I can provide some sample XML to get anybody going in the right direction.

[woodcock · Accepted solution]

It displays the events in the user's personal TZ setting already. All of the Timepicker values take this into account, too (e.g. "yesterday" is different depending on your TZ setting). The things is that you cannot, by default, see this. Here is what you have to do.
Run a search.
Go to Events tab.
Look at the leftmost control in the row of controls that exists below the timeline and above the events area. This can have 1 of 3 values: Raw, List or Table; make sure it is NOT Raw, I prefer List.
There is now a column to the right of the i information column called either Time or _time.
THIS is the user-TZ-normalized time value for the event.

[basilarockiaedw]

got a workaround.

Use this below search to get user specific timezone.

| rest /services/authentication/current-context|fields tz

Thanks,
Basil