topic Re: converting time to utc with "%Y-%m-%dT%H:%M:%S.%3fZ format in Splunk Search

converting time to utc with "%Y-%m-%dT%H:%M:%S.%3fZ format

dtakacssplunk — Tue, 30 Jan 2018 02:14:37 GMT

Hello I'm trying to convert an epoach time to the UTC time. I tried the following:

e.g. pageStartTime = 1517275826849
eval pageStartTimeDateTime=strftime(pageStartTime/1000, "%Y-%m-%dT%H:%M:%S.%f%Z") => 2018-01-29T17:30:26.849000PST
eval pageStartTimeDateTime2=strftime((pageStartTime)/1000, "%Y-%m-%dT%H:%M:%S.%3f%z") => 2018-01-29T17:30:26.849-0800

Note both have timezone qualifier which I do not want I want to have it in UTC.

How do I convert it so that the timestamp is something like this (utc time):
e.g . 1517275826849 => 2018-01-30T01:30:26.849Z

Re: converting time to utc with "%Y-%m-%dT%H:%M:%S.%3fZ format

493669 — Tue, 30 Jan 2018 03:11:43 GMT

Hi @dtakacssplunk,
Try this run anywhere search:

| makeresults |eval pageStartTime = "1517281593"|eval pageStartTimeDateTime=strftime(pageStartTime, "%Y-%m-%dT%H:%M:%S.%f%Z"), 
to_tz="UTC",from_tz="PST",
   from_t=strptime(strftime(pageStartTime, "%c.%6N " . from_tz), "%c.%6N %Z"),
   to_t=strptime(strftime(pageStartTime, "%c.%6N " . to_tz), "%c.%6N %Z"),
   offset=round((from_t-to_t)/60/60),
   converted=strftime(pageStartTime + (from_t-to_t), "%c")

Here PST time is converted into UTC

Re: converting time to utc with "%Y-%m-%dT%H:%M:%S.%3fZ format

dtakacssplunk — Tue, 30 Jan 2018 23:07:11 GMT

Thanks! is there any simpler way to do this?

Re: converting time to utc with "%Y-%m-%dT%H:%M:%S.%3fZ format

nabeel652 — Wed, 31 Jan 2018 01:03:14 GMT

Try this:

| stats count | fields - count | eval PageStartTime = 1517360016 | eval offset = tonumber(strftime(now(),"%z"))/100*3600 | eval PageStartTimeUTC = PageStartTime - offset | eval PageStartTimeUTC = strftime(PageStartTimeUTC,"%d/%m/%Y %H:%M:%S")

Explanation: PageStartTime is given a test value. offset is calculated by getting current user's timezone offset - converting it in seconds and subtracting it from the current time. If you're in a negative time zone subtraction will be converted to addition as a - (-b) = a + b. So the last PageStartTimeUTC shows the time in UTC