topic Convert timestamp from BST to EDT in Getting Data In

Convert timestamp from BST to EDT

davidcraven02 — Wed, 13 Jun 2018 09:13:22 GMT

My approach was to subtract 5 hours (18000 seconds) from the timestamp but when using the below line I get no results.

| eval timestamp =  timestamp - 18000

Full Query without subtraction

index=duo extracted_eventtype=authentication integration="Microsoft RDP" username=*
| eval Time=strftime(timestamp, "%H:%M") 
| eval day=strftime(timestamp, "%Y-%m-%d") 
| stats earliest(Time) by day, username  
| rename earliest(Time) as LogonTime 
| table username, day, LogonTime  
| sort username

I included the timestamp in the table to show its format.

Re: Convert timestamp from BST to EDT

renjith_nair — Wed, 13 Jun 2018 09:28:52 GMT

Try the substraction with the original time fields "_time" or convert it using strptime

     | eval BST_Time= _time - 18000

or use the relative_time function

|eval BST_Time=relative_time(_time,"-5h")

Re: Convert timestamp from BST to EDT

davidcraven02 — Wed, 13 Jun 2018 10:39:51 GMT

Thank you this worked.