topic Re: Convert time to another timezone then remove timezone identifier in Getting Data In

Convert time to another timezone then remove timezone identifier

michaelrosello — Wed, 27 Dec 2017 06:50:11 GMT

So I have multiple fields that have time value that looks like this.

2017-10-05T16:00:00Z

What I want is to convert it to GMT+8 then remove the extra parts and retain just the date instead using props.conf

2017-10-06

10-5 UTC converted to GMT+8 is 10-6

Re: Convert time to another timezone then remove timezone identifier

harsmarvania57 — Wed, 27 Dec 2017 07:16:45 GMT

Hi,

Can you please try below sample query (First line is used to generate dummy data)

| makeresults | eval field1="2017-10-05T16:00:00Z" 
| eval new_field=strftime(strptime(field1,"%Y-%m-%dT%H:%M:%SZ")+28800,"%Y-%m-%d")

I have created above query for single field only, if you have multiple field then you need to repeat for each field.

Re: Convert time to another timezone then remove timezone identifier

michaelrosello — Wed, 27 Dec 2017 07:20:08 GMT

It work but I'm trying looking at using props.conf as there is 23 fields to be exact that I need to convert.

Re: Convert time to another timezone then remove timezone identifier

abhijeet01 — Wed, 27 Dec 2017 07:45:46 GMT

Hi michaelrosello,

Please check below link. It will help you.
https://answers.splunk.com/answers/320021/how-do-i-set-timezone-properly-in-propsconf.html

Re: Convert time to another timezone then remove timezone identifier

harsmarvania57 — Wed, 27 Dec 2017 08:20:02 GMT

You can use below configuration in props.conf on Search head. In below configuration field1 contains actual timestamp and it will create new field with name new_field

[yoursourcetype]
EVAL-new_field = strftime(strptime(field1,"%Y-%m-%dT%H:%M:%SZ")+28800,"%Y-%m-%d")

EDIT: You need to repeat same config for 23 times so something like this

[yoursourcetype]
EVAL-new_field1 = strftime(strptime(field1,"%Y-%m-%dT%H:%M:%SZ")+28800,"%Y-%m-%d")
EVAL-new_field2 = strftime(strptime(field2,"%Y-%m-%dT%H:%M:%SZ")+28800,"%Y-%m-%d")
.........
.........
EVAL-new_field23 = strftime(strptime(field23,"%Y-%m-%dT%H:%M:%SZ")+28800,"%Y-%m-%d")