Hi,
For my customer we have the scenario where they are spanning multiple timezones, e.g. GMT+1 and GMT+4:30.
In splunk each user can setup their preferred timezone: https://docs.splunk.com/Documentation/UBA/5.3.0/User/Profile
That allows them to have an uniform view of all the data, typically UTC.
In DQL we can do a formatTimestamp to work around it - but I found no way to reliably use formatTimestamp and have it output UTC. In theory we can do it with parsing & then re-formatting it but that is cumbersome to add to every single query. Can we do this with formatTimestamp? (In Java you can also define the zone you want, I don't see that option here).
