<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to add 4 hours to each field in this Date time format? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-4-hours-to-each-field-in-this-Date-time-format/m-p/589039#M103335</link>
    <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/240815"&gt;@Kisame27&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;if this solution helped can you please accept it&amp;nbsp;&lt;/P&gt;&lt;P&gt;it might help others as well&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Tue, 15 Mar 2022 09:05:48 GMT</pubDate>
    <dc:creator>venky1544</dc:creator>
    <dc:date>2022-03-15T09:05:48Z</dc:date>
    <item>
      <title>How to add 4 hours to each field in this Date time format?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-4-hours-to-each-field-in-this-Date-time-format/m-p/587230#M103160</link>
      <description>&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Kisame27_0-1646229275934.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/18215i5291A951704803E8/image-size/medium?v=v2&amp;amp;px=400" role="button" title="Kisame27_0-1646229275934.png" alt="Kisame27_0-1646229275934.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;I have this date/time format, I need to add 4 hours to each field, can it be possible?&lt;/P&gt;
&lt;P&gt;if yes please help me&lt;/P&gt;</description>
      <pubDate>Thu, 03 Mar 2022 00:09:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-add-4-hours-to-each-field-in-this-Date-time-format/m-p/587230#M103160</guid>
      <dc:creator>Kisame27</dc:creator>
      <dc:date>2022-03-03T00:09:49Z</dc:date>
    </item>
    <item>
      <title>Re: Date time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-4-hours-to-each-field-in-this-Date-time-format/m-p/587248#M103168</link>
      <description>&lt;P&gt;hi&amp;nbsp;&lt;A href="https://community.splunk.com/t5/user/viewprofilepage/user-id/240815" target="_blank"&gt;@Kisame27&lt;/A&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;try this hope it should help&amp;nbsp;&lt;/P&gt;&lt;P&gt;|makeresults | eval _time= "2022-03-02T13:34:44.13Z"&lt;BR /&gt;|append [|makeresults | eval _time= "2022-03-02T07:34:05.727Z"]&lt;BR /&gt;|append [|makeresults | eval _time= "2022-03-02T08:16:10.203Z"]&lt;BR /&gt;|append [|makeresults | eval _time= "2022-03-02T06:44:19.867Z"]&lt;BR /&gt;|sort _time | eval reported_date = strptime(_time, "%Y-%m-%dT%H:%M:%S.%QZ") |eval newtime=reported_date+14400&lt;BR /&gt;|eval c_time=strftime(newtime,"%Y-%m-%dT%H:%M:%S.%QZ") |fields - newtime,reported_date&lt;/P&gt;</description>
      <pubDate>Wed, 02 Mar 2022 15:01:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-add-4-hours-to-each-field-in-this-Date-time-format/m-p/587248#M103168</guid>
      <dc:creator>venky1544</dc:creator>
      <dc:date>2022-03-02T15:01:33Z</dc:date>
    </item>
    <item>
      <title>Re: Date time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-4-hours-to-each-field-in-this-Date-time-format/m-p/587318#M103174</link>
      <description>&lt;P&gt;Ok, be a bit more specific what you want and why you want it because such time manipulation is quite often a sign of a try to manipulate timezones instead of changing actual time.&lt;/P&gt;&lt;P&gt;Anyway, to manipulate the time in any way, you firstly must parse it into a unix timestamp by using strptime, as &lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/137142"&gt;@venky1544&lt;/a&gt; already showed. Such parsed time will be rendered (if you use strftime or implicitly if the field is called _time) in your local timezone. Isn't it enough for you?&lt;/P&gt;</description>
      <pubDate>Wed, 02 Mar 2022 22:21:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-add-4-hours-to-each-field-in-this-Date-time-format/m-p/587318#M103174</guid>
      <dc:creator>PickleRick</dc:creator>
      <dc:date>2022-03-02T22:21:48Z</dc:date>
    </item>
    <item>
      <title>Re: How to add 4 hours to each field in this Date time format?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-4-hours-to-each-field-in-this-Date-time-format/m-p/589021#M103333</link>
      <description>&lt;P&gt;Thanks&amp;nbsp;&amp;nbsp;&lt;span class="lia-unicode-emoji" title=":smiling_face_with_heart_eyes:"&gt;😍&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 15 Mar 2022 06:24:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-add-4-hours-to-each-field-in-this-Date-time-format/m-p/589021#M103333</guid>
      <dc:creator>Kisame27</dc:creator>
      <dc:date>2022-03-15T06:24:31Z</dc:date>
    </item>
    <item>
      <title>Re: How to add 4 hours to each field in this Date time format?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-add-4-hours-to-each-field-in-this-Date-time-format/m-p/589039#M103335</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/240815"&gt;@Kisame27&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;if this solution helped can you please accept it&amp;nbsp;&lt;/P&gt;&lt;P&gt;it might help others as well&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 15 Mar 2022 09:05:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-add-4-hours-to-each-field-in-this-Date-time-format/m-p/589039#M103335</guid>
      <dc:creator>venky1544</dc:creator>
      <dc:date>2022-03-15T09:05:48Z</dc:date>
    </item>
  </channel>
</rss>

