topic Re: Convert from timezone UTC to CET in Dashboards & Visualizations

Convert from timezone UTC to CET

Uppe — Wed, 03 Jan 2024 15:05:56 GMT

Hello,

I created a dashboard with one column of timeStamp EndTimeUTC which stores AH_TIMESTAMP4 or EHActivityItem.EH_ENDTIME. That works.

result= 2024-01-01 10:09:28

Now the customer wants to see the time in timezone CET. I can show him the offset time with

| eval "EndTime (CET)"=strftime(strptime(EndTimeUTC,"%Y-%m-%d %T"),"%Y-%m-%d %T %z")

result: 2024-01-01 10:09:28 +0100

But how can I show the time in a calculated format ?

expected result: 2024-01-01 11:09:28

Thanks!

Re: Convert from timezone UTC to CET

PickleRick — Wed, 03 Jan 2024 21:27:59 GMT

Splunk always renders the time (either when you explicitly call strftime() or when it displays the _time field) according to the user's timezone set in preferences for said user.

There is no way to specify another timezone for time display.

The only way you can try to "cheat the system" is to add an artificial offset to the timestamp and pretend it's rendered in another timezone but it's an ugly and a bit unreliable solution.

Re: Convert from timezone UTC to CET

Uppe — Wed, 10 Jan 2024 07:06:06 GMT

Thank you for your answer. I have set the timezone CET in my settings of SPLUNK, but the time I get from database is UTC.

How I have to format the time that it is shown in my timezone?

Best regards Dana

Re: Convert from timezone UTC to CET

PickleRick — Wed, 10 Jan 2024 07:50:34 GMT

I'm not sure what you have (You're a bit vague on the details 😉 it's best if you show what you have in terms of data - post some (anonymized if nedded) examples of your events). But if you're trying to strptime() on a string without a timezone information embedded in it - it's also gonna be done in your local timezone. So if you want to interpret a timestamp from another zone you'd need to manually add that timezone information to the time string.

But it's still best if you show us your data - we'll see what you have and what can be done with it 🙂