topic Re: timechart with timezone in Splunk Search

timechart with timezone

vishal1 — Wed, 04 Sep 2013 05:12:49 GMT

I have executed the command "timechart" and got output in the below formate.
4/1/13 12:00:00.000 AM
5/1/13 12:00:00.000 AM

Excpected Output.
4/1/13 12:00:00.000 AM EDT
5/1/13 12:00:00.000 AM EDT

I need to add timeZone to the output TimeStamp.

Please direct me with the command to get the expected output

HiroshiSatoh — Wed, 04 Sep 2013 09:07:34 GMT

If you simply need to add a time zone

(ex.)
･････|eval zTime=strftime(_time,"%m/%d/%y %H:%M:%S.%3N %p %Z")

vishal1 — Wed, 04 Sep 2013 09:53:56 GMT

I want to use the timechart command so that i can view data/per day.

Please guide me how i can add timeZone using "timechart" command

HiroshiSatoh — Wed, 04 Sep 2013 12:06:31 GMT

Display did not change even if conversion and end up in the _time field name. Is it useless in another field?

(ex.)
･････|timechart span=1h count|eval ztime=strftime(_time,"%y/%m/%d %H:%M:%S.%3N %p %Z") | fields + ztime,count|fields - _time