How to calculate accurate time from .csv?

jaydiare — Fri, 09 Dec 2022 19:47:38 GMT

Hello Splunk community, I need some help with the following:

I have a .csv file that is being created at a Pacific Time Zone, and the hour and date of the events I need to track are 2 separate fields in this .csv name : Date ( 09/12/2022) and "Begin Time" (06:30).

I want to table my events based on those two fields, as my time reference and not the _time (2022-12-09T10:41:02.000-05:00 )when the file was exported to Splunk which is actually a different time zone ( eastern)

What would it be the best way using those two fiels ( Date & "Begin Time") to accuratelly display the events in my .csv

thanks for your help

Re: Calculate accurate time from .csv

richgalloway — Fri, 09 Dec 2022 17:50:22 GMT

After reading the CSV file, you can use eval to set the _time field to a combination of the two (or more) fields.

| eval _time = strptime(Date . 'Begin Time', "%m/%d/%Y%H:%M:%SEST")

topic Re: Calculate accurate time from .csv in Splunk Search

How to calculate accurate time from .csv?

Re: Calculate accurate time from .csv