I have a panel which shows the usage of a dashboard in GMT timezone. Is it possible to show the same data in different timezones (PST, EST, IST, etc) as different lines in same chart?
Below is the query which shows count in GMT timezones
index="_internal" user!="-" sourcetype=splunkd_ui_access "GET" "sample"
| rex field=uri "\/app\/(?<App_Value>\w+)\/(?<dashboard>[^?\/]+)"
| search App_Value="sample" dashboard = "daily_health"
|timechart count
How can we modify this query to show in different timezone in single chart?
Your question boils down to the often posted one - "can we display data in another timezone". The general answer is "no". The timestamp itself is stored by Splunk as number of seconds since epoch (Jan 1st 1970) and is rendered in the UI according to user's timezone settings. And short of modifying the actual timestamp and "cheating" this way there's no way to display a timestamp's represenation in different timezone.
Assuming you have extracted the timezone into a field (tz), you could add it as a by clause to the timechart
| timechart count by tz