topic Re: API: How to specify returning dates with a UTC or GMT offset rather than a CDT time zone? in Splunk Search

API: How to specify returning dates with a UTC or GMT offset rather than a CDT time zone?

artrune — Fri, 21 Jun 2019 00:52:35 GMT

How can I specify Splunk to return dates with a UTC or GMT offset rather than a time zone abbreviation?
Right now I get back information like this:

{"preview":false,"offset":31,"result":{"_time":"2019-06-17 17:30:00.000 CDT","Value":"97.038000"}}

I would like to have a UTC offset instead of the time zone abbreviation CDT.

Any clues?

Re: API: How to specify returning dates with a UTC or GMT offset rather than a CDT time zone?

renjith_nair — Fri, 21 Jun 2019 01:39:12 GMT

@artrune ,

You can use %z in the time format

Reference : https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Commontimeformatvariables#Time_variables
E.g.

|eval formatted=strftime(_time,"%d-%m-%Y %H:%M:%S %z")

Re: API: How to specify returning dates with a UTC or GMT offset rather than a CDT time zone?

artrune — Fri, 21 Jun 2019 15:19:38 GMT

Thanks for the answer, this helped alot, However is there a way for _time to assume that value? Because if not it creates an extra variable called formatted that contains the formatted date.
I would like a workaround but if not possible I can live with that.
I will try renaming in the mean time and see what happens

Re: API: How to specify returning dates with a UTC or GMT offset rather than a CDT time zone?

renjith_nair — Sat, 22 Jun 2019 02:01:16 GMT

@artrune , yes you can directly assign the converted values to _time instead of an extra variable ,

|eval _time=strftime(_time,"%d-%m-%Y %H:%M:%S %z")

However, its advised not to change _time, especially if you are using it for any other operation in the search.