In an environment that provides reporting across many different time zones, should summary searches run under a user set to the default system time, GMT time, or doesn't it matter since Splunk will adjust the time based on the user's time zone?
Generally, it doesn't matter because the _time
field that is created for the events in the summary index is always normalized to GMT epoch. There is one thing to consider, though; if you are using any snap-to
definitions, these may be effected by the user's Time zone
value. For example, if your TZ offset is not an even-hour (I just read that North Korea is dropping 30 minutes from their TZ), then @h
for one user may be 30 minutes different than @h
for another user. The same concern exists for relative day specifiers anywhere they exist (not just for the snap-to
part) because where midnight falls (e.g. where the DayChange time is), may be different for different users so the window for day
can be different from user-to-user.