Splunk Search

What does "yesterday" mean when data is spanning multiple timezones?

matt
Splunk Employee
Splunk Employee

What is the expected outcome of the "Yesterday" time function when applied to data from multiple timezones. I have a report that brings data back from Berlin, Sydney and Cleveland. I would like to run the report once per day for "Yesterday's" data, but each region will have a slightly different definition of "Yesterday" based on the local timezone.

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

The "yesterday" time span is always with respect to the timezone on the search head. You can achieve your goal by setting up a separate search head per timezone, and search only the relevant data on each search head.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

The "yesterday" time span is always with respect to the timezone on the search head. You can achieve your goal by setting up a separate search head per timezone, and search only the relevant data on each search head.

alexander_lucas
Explorer

And how to do this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...