topic Re: Striftime Error or Settings questions in Splunk Search

Striftime Error or Settings questions

hyungjoon — Mon, 17 Dec 2018 13:57:23 GMT

For some reason when I have Time as below, and use (| eval SortingTime=strftime(SortingTime, " %H:%M:%S") I always get exactly 1more hour to what I should get.

So if I use | eval SortingTime=strftime(SortingTime, " %H:%M:%S") , I would get 01:23:39 instead of 00:23:39 and same goes for everytime I try to use strftime, I always get an extra hour

I have 2 accounts. one account seems to get the right strftime but the other one always adds an extra hour to strftime. Is there something wrong with my settings???

Re: Striftime Error or Settings questions

harsmarvania57 — Mon, 17 Dec 2018 14:05:30 GMT

Do you have timezone specified for account in which you are getting +1 hour ?

Or try below query

<yourBaseSearch>
| eval SortingTime=tostring(SortingTime, "duration")

Re: Striftime Error or Settings questions

hyungjoon — Mon, 17 Dec 2018 15:55:13 GMT

yes I have timezone specified for both account but they are specified to the same timezone. I don't know why one would give me +1 hour while the other won't. Is there anyway I can fix this?

Re: Striftime Error or Settings questions

harsmarvania57 — Mon, 17 Dec 2018 16:55:28 GMT

If you would like to convert 1419.000000 into Duration then you need to use | eval SortingTime=tostring(SortingTime, "duration")

Re: Striftime Error or Settings questions

harsmarvania57 — Mon, 17 Dec 2018 16:56:06 GMT

If you would like to convert 1419.000000 into Duration then you need to use | eval SortingTime=tostring(SortingTime, "duration")