How to change the timestamp field in IDR

Hi.

Is there a way in log search to change the time from UTC to EST?

Platform Home → Administration → SIEM Settings. Under user preference change the time zone from UTC to browser local will work. Assuming you are on the east coast

1 Like

Hi @mblough I’ve had that set for a long time but it’s still showing UTC

1 Like

Changing the user profile setting will only change the ingestion timestamp, the value in the timestamp field is normalized to UTC and cannot be changed

1 Like