Yeah that request was from a different viz. The top entry shows this at the moment:
And looking at the response via the inspect
tool, the raw value for @timestamp
is:
So I think it's safe to say that my dashboards are displaying time in UTC. Going a bit further, here's what the equivalent looks like in the SIEM app. A little difficult to see the record in the background, but notice how the raw value in the response is 2020-02-11 23:59:55
yet the events table (background) shows Feb 12, 2020 @ 07:59:55.000
:
Thanks again for the continued help!