How to get your splunk timezone difference with GMT
| makeresults
| eval timezone=tonumber(mvindex(split(strftime(_time,"%FT%T %:::z")," "),1))My daily IT journal
| makeresults
| eval timezone=tonumber(mvindex(split(strftime(_time,"%FT%T %:::z")," "),1))