topic Re: Time stamp format to round to nearest hour GMT Timezone in Getting Data In

Time stamp format to round to nearest hour GMT Timezone

Sammy13 — Tue, 15 Nov 2022 19:23:54 GMT

I have a start time column in splunk in this format:
19:10:54:19
I have a start date column in this format: 2022-11-15
I also have a time zone column in this format: -500

How can I get a new column with time rounded up to the next hour, in GMT.
Example of output: Mon Mar 21 18:00:00 GMT 2022

Thanks!

Re: Time stamp format to round to nearest hour GMT Timezone

richgalloway — Tue, 15 Nov 2022 21:03:39 GMT

If you put the three fields together into a single string then you can use strptime, relative_time, and strftime to do the job. Note that Splunk always displays timestamps in the user's selected time zone. There is no way to force GMT (or any other time zone).

See if this helps.

| eval timestamp=start_date . " " . start_time . time_zone | eval epoch = strptime(timestamp, "%Y-%m-%d %H:%M:%S:%2N%z") | eval display_string = strftime(relative_time(epoch,"+1h@h"), "%a %b %d %H:%M:%S %Z %Y")

Re: Time stamp format to round to nearest hour GMT Timezone

Sammy13 — Tue, 15 Nov 2022 21:11:53 GMT

Thanks a lot will apply and see if it works