| makeresults
| eval timezone=tonumber(mvindex(split(strftime(_time,”%FT%T %:::z”),” “),1))
How to get your splunk timezone difference with GMT
2025-03-01
| makeresults
| eval timezone=tonumber(mvindex(split(strftime(_time,”%FT%T %:::z”),” “),1))