Search using time bins and spans
Time zones and time bins
You can use the
timechart commands to organize your search results into time bins.
Time bins are calculated based on <bin-options> settings, such as
span. For more about how time bins are calculated, see
Search using time bins and spans.
When the time bins cross multiple days or months the bins are aligned to the local day boundary.
The events returned are the same for the time range since the events are processed using UNIX time. But some events in might appear in one bin in a timezone, and in another bin in a different timezone.
Another example is the time range for the search.
When you specify a time range, either through the time range picker or explicitly in the search with the "earliest" and "latest" time (modifiers), the events are processed based on which time range is used.
If the search specifies "Last 24 hours", then the search processes the events using UTC time. The same set of events are returned for a user in SF and a user in Tokyo.
If the search specifies "Since midnight today", the search processes events based on the midnight of the timezone, not UTC time. A different set of events are returned for a user in SF and a user in Tokyo, because the time that midnight occurs is different in each timezone.
If the search uses a snap-to time, such as @d or @mon, the search processes events based on the "day" or "month" of the timezone, not UTC time. A different set of events are returned for a user in SF and a user in Tokyo, because the time that midnight occurs is different in each timezone.
Use time to find nearby events
How time zones are processed by the Splunk platform
This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1