https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421013#M120956 <P>Another option</P> <P>| eval "Event_Time"= strftime(_time,"%m/%d/%Y %H:%M:%S %Z")</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables</A> </P> Wed, 30 Sep 2020 03:45:07 GMT jaxjohnny2000 2020-09-30T03:45:07Z https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421007#M120950 <P>HI All,</P> <P>My name group extracts date time filed in the below format<BR /> E.g: 21/Jan/2019 09:35:25 UTC</P> <P>I would like to convert it to AEST format on the fly and also it should not provide me the timezone details, rather than changing the prop file.</P> Sun, 21 Apr 2019 08:26:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421007#M120950 mail2uharishp 2019-04-21T08:26:37Z https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421008#M120951 <P>Hi Harish you can try this way..<BR /> | eval "UTCepoch"= strptime(Date,"%d/%b/%Y %H:%M:%S %Z") , "AESTepoch=(UTCepoch +36000) , "AESTdate"= strftime(AESTepoch,"%d/%b/%Y %H:%M:%S %Z")</P> <P>In this way you will get date format in UTC to AEST.<BR /> Here 36000 is time gap between UTC and AEST in seconds. </P> Sun, 21 Apr 2019 08:51:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421008#M120951 maityayan1996 2019-04-21T08:51:29Z https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421009#M120952 <P>Login to Splunk, go to <CODE>Your Login Name Here</CODE> -&gt; <CODE>Preferences</CODE> -&gt; <CODE>Time zone</CODE> and pick your preferred presentation TZ. Then in your searches, on the <CODE>Events</CODE> tab, make sure that you select <CODE>Table</CODE> or <CODE>List</CODE> view (above the <CODE>i</CODE>). You will now have a separate <CODE>Tme</CODE> (or <CODE>_time</CODE>) column that shows the TZ-adjusted time.</P> Sun, 21 Apr 2019 14:35:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421009#M120952 woodcock 2019-04-21T14:35:01Z https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421010#M120953 <P>Hi Maityayan,</P> <P>in the above eval function we have hardcoded 36000 sec addition to UTC time, however during the daylight changes it will be made to 39600, Can i get to do that calculation dynamically?</P> <P>Thanks,<BR /> Harish</P> Sun, 21 Apr 2019 23:04:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421010#M120953 mail2uharishp 2019-04-21T23:04:46Z https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421011#M120954 <P>Hi Woodcock,</P> <P>Thank you for your response, however was not preferring to change any preferences or prop file to get the desired out come, I was looking to change the time change on the fily .</P> Sun, 21 Apr 2019 23:07:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421011#M120954 mail2uharishp 2019-04-21T23:07:22Z https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421012#M120955 <P>Use this</P> <P>Search... | eval "Local_Time"= strftime(_time,"%d/%b/%Y %H:%M:%S %Z")</P> Wed, 30 Sep 2020 03:45:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421012#M120955 jaxjohnny2000 2020-09-30T03:45:05Z https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421013#M120956 <P>Another option</P> <P>| eval "Event_Time"= strftime(_time,"%m/%d/%Y %H:%M:%S %Z")</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables</A> </P> Wed, 30 Sep 2020 03:45:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-covert-Date-and-Time-with-timezone-display/m-p/421013#M120956 jaxjohnny2000 2020-09-30T03:45:07Z