topic Re: How to get non-abbreviated time-zone? in Getting Data In

How to get non-abbreviated time-zone?

georgiawebber — Tue, 28 Aug 2018 06:07:57 GMT

Is there a way to display the full timezone and not just the abbreviation? The SPL I am currently using is:

| eval zone=strftime(time(),"%Z %z")

However this just gives me the abbreviation (i.e. "AEST +1000"). I would like it to display "Australian Eastern Standard Time +1000".

Re: How to get non-abbreviated time-zone?

woodcock — Wed, 05 Sep 2018 01:36:45 GMT

These Q&A links should give you what you need (be sure to UpVote the answers that help):

https://answers.splunk.com/answers/590067/how-do-i-map-my-personally-tz-adjusted-time-to-ano.html
https://answers.splunk.com/answers/127193/where-are-splunk-valid-tz-options-in-propsconf.html

Re: How to get non-abbreviated time-zone?

Noah_Woodcock — Wed, 05 Sep 2018 02:54:14 GMT

You can also scrape things like wikipedia and make your own lookups with apps like these:
https://splunkbase.splunk.com/app/4146/
https://splunkbase.splunk.com/app/3226/
https://splunkbase.splunk.com/app/635/

Re: How to get non-abbreviated time-zone?

efavreau — Wed, 05 Sep 2018 13:02:32 GMT

If it's consistently like in your question, here's a run anywhere example that everytime the zone field start with "AEST", it will replace it with "Australian Eastern Standard Time".

| makeresults
| eval zone=strftime(time(),"%Z %z")
| rex mode=sed field=zone "s/^(AEST)/Australian Eastern Standard Time/"

The makeresults command is simply to get it to work as an example, but what you need after your eval statement, is the third line.

Re: How to get non-abbreviated time-zone?

efavreau — Thu, 06 Sep 2018 14:27:50 GMT

@georgiawebber Did this solution work for you? Did you need to clarify your question? Please remember to accept the answer that helped, or clarify your question/comment on the answers that are close.

Re: How to get non-abbreviated time-zone?

Anam — Mon, 17 Sep 2018 17:15:09 GMT

Hi @georgiawebber

I am the Community Content Specialist for Splunk Answers. If any of the answers worked for you please go ahead and accept it, if not let the community know if you need more clarification.

Thanks

Re: How to get non-abbreviated time-zone?

georgiawebber — Mon, 17 Sep 2018 21:31:55 GMT

Oops! Sorry I forgot I had this question out there. Have now accepted!