topic Re: Eval to find current time in another timezone in Getting Data In

Eval to find current time in another timezone

BP9906 — Mon, 12 May 2014 22:50:58 GMT

I'm familiar with strftime and starptime command and timezones, but cant seem to manipulate now() and convert to a known timezone. As an example now() returns in PDT timezone and I would like to convert now() to CST6CDT. I tried using eval to do a diff but it doesnt return the field. Any idea why?

| eval time_diff=strptime("CST6CDT", "%Z")

Re: Eval to find current time in another timezone

martin_mueller — Mon, 12 May 2014 23:12:25 GMT

Might not be what you're looking for, but you can change the time zone your Splunk user is in to make Splunk display all times appropriately.

Re: Eval to find current time in another timezone

MuS — Tue, 13 May 2014 06:02:20 GMT

Hi BP9906,

try this run everywhere command:

index=_internal | head 1 | eval AKDT="-8h" | eval CEST="+2h" | eval foo=relative_time(now(), AKDT ) | eval boo=relative_time(now(), CEST ) | eval foo=strftime(foo, "%Y-%m-%d %H:%M:%S.%3N" ) | eval boo=strftime(boo, "%Y-%m-%d %H:%M:%S.%3N" ) | table foo boo

the times for foo and boo are in AKDT (Alaska Daylight Time) and CEST (Central European Summer Time). As you can see I had to eval them first and then use them with relative_time.

To take this one step further, you could setup some automatic lookup containing all TZ and use them to do your time calculations.

hope this helps ...

cheers, MuS

Re: Eval to find current time in another timezone

nekb1958 — Tue, 13 May 2014 07:24:05 GMT

Hi MuS
great search, it inspired me to look a little closer and do it even more general (i wondered first why you eval´ed AKDT and CEST), with only one timeformat string

index=_internal | head 1 | eval foo=relative_time(now(), "-90m@s" ) | eval boo=relative_time(now(), "+21m@s" ) | eval now=now() | convert timeformat="%d.%m.%y %H:%M:%S" ctime(now), ctime(foo), ctime(boo) | t

Re: Eval to find current time in another timezone

BP9906 — Tue, 13 May 2014 14:33:37 GMT

Thank you both for feedback. I also found another Splunk search that will convert the offset value (ie -0400) to relative time and then change it. This is almost what I'm looking for. The problem is that I have all our customer's timezones and I would like to create the alert based on their local business hours. So if the time is between these local business hours, send the alert. The timezone codes are all the standardized notation that Splunk (python) supports but it seems like trying to convert the timezone code to epoch time doesnt work.

Re: Eval to find current time in another timezone

BP9906 — Tue, 13 May 2014 14:34:15 GMT

Close but not quite: http://answers.splunk.com/answers/4528/finding-your-local-timezone-with-eval

Re: Eval to find current time in another timezone

arthurh — Sun, 16 Apr 2017 15:29:28 GMT

I needed to get the current time in UTC timezone:

 | eval utc_hourid=strftime(relative_time(now(),"+".(tonumber(strftime(now(),"%H"))-tonumber(strftime(strptime(strftime(now(),"%m/%d/%Y %H:%M:%S UTC"),"%m/%d/%Y %H:%M:%S %Z"),"%H")))."h"),"%m/%d/%Y %H:%M:%S")

You can probably turn this eval exp to get current time in any timezone, just replace "UTC" with the timezone you want. This work with daylight savings time