topic Re: Convert GMT to CST timezone in Getting Data In

Convert GMT to CST timezone

ravir_jbp — Wed, 22 Nov 2023 11:44:53 GMT

I am trying to conver the GMT time to CST time. I am able to get the desire data using below query. Now I am looking for query to convert GMT time to CST.

index=test AcdId="*" AgentId="*" AgentLogon="*" chg="*" seqTimestamp"*" currStateStart="*" currActCodeOid="*" currActStart="*" schedActCodeOid="*" schedActStart="*" nextActCodeOid="*" nextActStart="*" schedDate="*" adherenceStart="*" acdtimediff="*"
| eval seqTimestamp=replace(seqTimestamp,"^(.+)T(.+)Z$","\1 \2")
| eval currStateStart=replace(currStateStart,"^(.+)T(.+)Z$","\1 \2")
| eval currActStart=replace(currActStart,"^(.+)T(.+)Z$","\1 \2")
| eval schedActStart=replace(schedActStart,"^(.+)T(.+)Z$","\1 \2")
| eval nextActStart=replace(nextActStart,"^(.+)T(.+)Z$","\1 \2")
| eval adherenceStart=replace(adherenceStart,"^(.+)T(.+)Z$","\1 \2")
| table AcdId, AgentId, AgentLogon, chg, seqTimestamp,seqTimestamp1, currStateStart, currActCodeOid, currActStart, schedActCodeOid, schedActStart, nextActCodeOid, nextActStart, schedDate, adherenceStart, acdtimediff

Below are the results I am getting:

Re: Convert GMT to CST timezone

ITWhisperer — Wed, 22 Nov 2023 12:11:36 GMT

You need to add (or subtract) the timezone offset from the times. To do this, you should parse the time strings to epoch datetimes with strptime(), change the time appropriately, and then reformat them with strftime().

Re: Convert GMT to CST timezone

ravir_jbp — Thu, 23 Nov 2023 06:42:22 GMT

Hello @ITWhisperer can you give me one example on how to convert that

Re: Convert GMT to CST timezone

PickleRick — Thu, 23 Nov 2023 07:27:21 GMT

To add to @ITWhisperer 's answer - Splunk processes timestamp as "unix timestamps" - integers containing number of seconds since epoch. As such, timestamp is "timezoneless", it's just rendered when needed into a string, possibly containing a timezone description. But timestamp is always (when rendered automatically by WebUI or explicitly when strftime is called) rendered in user's timezone (the one set in user's preferences).

So while with strptime you can read and apply the timezone offset from the string representation of a given point in time, strftime doesn't let you specify the timezone freely.

The only thing you can do is "cheat" a bit by manually adjusting the timezone with the offset to another timezone and render it in your local timezone but without displaying said timezone.

Re: Convert GMT to CST timezone

ITWhisperer — Thu, 23 Nov 2023 09:08:11 GMT

| eval curActStart=strftime(strptime(curActStart,"%F %T.%S")+(60*60*5)+(60*30),"%F %T.%S")