topic Timezone in Getting Data In

Timezone

Khuzair81 — Mon, 07 Jun 2021 11:01:51 GMT

How to convert the below the time field from GMT to EST.

time=Jun 7, 2021 10:24:33 AM GMT

i tried below

| eval t=strftime(strptime(time, "%m %d, %y %H:%M:%S %Z"), "%H:%M:%S")

I'm not getting the result

Re: Timezone

richgalloway — Mon, 07 Jun 2021 12:49:38 GMT

The strptime format string doesn't match the sample time string. Try this

| eval t=strftime(strptime(time, "%b %d, %y %H:%M:%S %p %Z"), "%H:%M:%S")

Re: Timezone

Khuzair81 — Tue, 08 Jun 2021 09:01:11 GMT

@richgalloway i want to get the data only from yesterday is there anyway to write it in Query

Can i use | where Date=-1d@d

Re: Timezone

richgalloway — Tue, 08 Jun 2021 12:53:27 GMT

This should be a new posting, but, yes, you can do that, however not using where. To search only yesterday, use the earliest and latest options to the search command.

index=foo earliest=-1d@d latest=@d