topic Re: How to convert GMT to EDT? in Getting Data In

How to convert GMT to EDT?

davidcraven02 — Tue, 10 Apr 2018 14:44:22 GMT

How could I convert this GMT time to EDT?

index="wineventlog" host=opdc* Account_Name=*test_user EventCode=4624 
| makemv Account_Name
| mvexpand Account_Name
| eval day=strftime(_time, "%d-%m-%y") 
| join type=left src_ip 
    [ search index=ad source=addnsscan earliest=-12h@h latest=now 
    | rename data as src_ip, name as hostname
    | fields src_ip, hostname] 
| stats earliest(_time) AS earliest by Account_Name, src_ip, hostname, day 
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S %Z")

Re: How to convert GMT to EDT?

somesoni2 — Tue, 10 Apr 2018 15:05:06 GMT

Give this a try
Updated

index="wineventlog" host=opdc* Account_Name=*test_user EventCode=4624 
 | makemv Account_Name
 | mvexpand Account_Name
 | eval day=strftime(_time, "%d-%m-%y") 
 | join type=left src_ip 
     [ search index=ad source=addnsscan earliest=-12h@h latest=now 
     | rename data as src_ip, name as hostname
     | fields src_ip, hostname] 
 | stats earliest(_time) AS earliest by Account_Name, src_ip, hostname, day 
| eval offset=strptime("00:00Z","%H:%M%Z")-strptime("00:00EDT","%H:%M%Z")
 | eval earliest=strftime(earliest+offset,"%d/%m/%Y %H.%M.%S %Z")
| fields - offset

Re: How to convert GMT to EDT?

davidcraven02 — Tue, 10 Apr 2018 16:28:17 GMT

Thank you for this but the earliest field is blank.

Re: How to convert GMT to EDT?

somesoni2 — Tue, 10 Apr 2018 17:44:15 GMT

Try the updated answer. Fixed a typo in first strptime in eval for offset.

Re: How to convert GMT to EDT?

davidcraven02 — Tue, 10 Apr 2018 19:51:19 GMT

Perfect thank you!!