The starting time of search with timechart doesn’t match the local timezone.

[kinaba_splunk]

When bucket time is between 03/08/2018 00:00:00 and 03/08/2018 24:00:00 with JST (GMT+9) as timezone, the starting time of search doesn’t match the local timezone.

Example)

index=xxx | timechart count span=12h 

Expected result:
Starting time should be 03/08/2018 00:00:00 and then, +12h would be
03/08/2018 12:00:00.

Actual result:
Starting time gets 03/07/2018 15:00:00 and then, +12h would be
03/08/2018 03:00:00.

Could you tell me why?

[kinaba_splunk · Accepted solution]

Span option is always rounding down the starting date (first bin) in a specific way by design.
Thus, there is no guarantee that start time bin used by timechart is corresponding to local timezone.

Even bucket time is between 03/08/2018 00:00:00 and 03/08/2018 24:00:00 based on certain timezone,
the start time of search doesn’t always match the same.

Workaround might be as below.

index=* | eval day=strftime(_time, "%u.%A")
| bucket date_hour span=12
| chart count by date_hour day

Enhancement request related with spap and timezone is below.
SPL-148967 Align the start of the first time bucket to the start time of a search.