What is the expected outcome of the "Yesterday" time function when applied to data from multiple timezones. I have a report that brings data back from Berlin, Sydney and Cleveland. I would like to run the report once per day for "Yesterday's" data, but each region will have a slightly different definition of "Yesterday" based on the local timezone.
The "yesterday" time span is always with respect to the timezone on the search head. You can achieve your goal by setting up a separate search head per timezone, and search only the relevant data on each search head.
The "yesterday" time span is always with respect to the timezone on the search head. You can achieve your goal by setting up a separate search head per timezone, and search only the relevant data on each search head.
And how to do this?