Skip to content

Instantly share code, notes, and snippets.

@acharlieh
Created August 17, 2019 20:09
Show Gist options
  • Save acharlieh/9e2f849eaa408db72b3a63e45c915139 to your computer and use it in GitHub Desktop.
Save acharlieh/9e2f849eaa408db72b3a63e45c915139 to your computer and use it in GitHub Desktop.
Timezone Test Splunk Dashboard
<dashboard>
<label>Timezone Test</label>
<row>
<panel>
<title>User Info</title>
<single>
<title>User Time Zone</title>
<search id="info">
<query>
<![CDATA[
| rest /services/authentication/current-context splunk_server=local f=tz
| fields tz
| eval tz=if(tz="","<system>",tz),_hourfmt="%Y-%m-%dT%H"
| fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S %z")
]]>
</query>
<earliest>0</earliest>
<latest>1</latest>
</search>
<option name="field">tz</option>
</single>
<single>
<title>Current time (User Time Zone)</title>
<search base="info">
<query>eval _time=now()</query>
</search>
<option name="field">_time</option>
</single>
</panel>
</row>
<row>
<panel>
<title>USA - DST Begin</title>
<single>
<title>Noon day of transition</title>
<search id="us_begin" base="info">
<query>eval _time=strptime("2019-03-10T12",_hourfmt)</query>
</search>
<option name="field">_time</option>
</single>
<single>
<title>@d</title>
<search base="us_begin">
<query>eval _time=relative_time(_time,"@d")</query>
</search>
<option name="field">_time</option>
</single>
<single>
<title>@d+7h</title>
<search base="us_begin">
<query>eval _time=relative_time(_time,"@d+7h")</query>
</search>
<option name="field">_time</option>
</single>
</panel>
</row>
<row>
<panel>
<title>USA - DST End</title>
<single>
<title>Noon day of transition</title>
<search id="us_end" base="info">
<query>eval _time=strptime("2019-11-03T12",_hourfmt)</query>
</search>
<option name="field">_time</option>
</single>
<single>
<title>@d</title>
<search base="us_end">
<query>eval _time=relative_time(_time,"@d")</query>
</search>
<option name="field">_time</option>
</single>
<single>
<title>@d+7h</title>
<search base="us_end">
<query>eval _time=relative_time(_time,"@d+7h")</query>
</search>
<option name="field">_time</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Lord Howe Island - DST End</title>
<single>
<title>Noon day of transition</title>
<search id="lhe_end" base="info">
<query>eval _time=strptime("2019-04-07T12",_hourfmt)</query>
</search>
<option name="field">_time</option>
</single>
<single>
<title>@d</title>
<search base="lhe_end">
<query>eval _time=relative_time(_time,"@d")</query>
</search>
<option name="field">_time</option>
</single>
<single>
<title>@d+7h</title>
<search base="lhe_end">
<query>eval _time=relative_time(_time,"@d+7h")</query>
</search>
<option name="field">_time</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Lord Howe Island - DST Begin</title>
<single>
<title>Noon day of transition</title>
<search id="lhe_begin" base="info">
<query>eval _time=strptime("2019-10-06T12",_hourfmt)</query>
</search>
<option name="field">_time</option>
</single>
<single>
<title>@d</title>
<search base="lhe_begin">
<query>eval _time=relative_time(_time,"@d")</query>
</search>
<option name="field">_time</option>
</single>
<single>
<title>@d+7h</title>
<search base="lhe_begin">
<query>eval _time=relative_time(_time,"@d+7h")</query>
</search>
<option name="field">_time</option>
</single>
</panel>
</row>
</dashboard>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment