topic Re: How do i convert CEST to IST? in Splunk Search

How do i convert CEST to IST?

Joshi_18 — Tue, 25 Apr 2023 06:54:18 GMT

I'm new to splunk, can anyone help me to make convert time from CEST to IST using query.

Re: How do i convert CEST to IST?

SanjayReddy — Tue, 25 Apr 2023 07:09:20 GMT

Hi @Joshi_18

this post might help you

https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-and-time-in-UTC-to-EST/m-p/204873

Re: How do i convert CEST to IST?

PickleRick — Tue, 25 Apr 2023 08:06:04 GMT

OK. There is one thing you need to know about time manipulation in Splunk.

Splunk internally processes time as so called "unix timestamp" which means that it's just a number of seconds since Jan 1st 1970 0:00:00 UTC. So I'm writing this at a point in time which has 1682409489 timestamp.

If Splunk renders this time into a string value (either automatically as it does for the _time field or when you explicitly call the strftime()) function - it always uses the timezone defined for your user in preferences. And there is no way around it.

The soultion to which @SanjayReddy pointed you to is the only way to "cheat" Splunk - it effectively changes the timestamp to be rendered (so that you don't just render your given timestamp in another timezone but rather shift the whole timestamp by the timezone-specified offset), renders that timestamp in your local timezone (as I said - there is no way around it) and just doesn't show the timezone information (and optionally "glues" the fake "destination timezone" code). It is a very ugly hack and generally you should never do that and there is a very good rationale for keeping to one timezone - it prevents the confusion among your users.

So long story short - question is whether IST is your local timezone and you just want to parse the timestamp from logs from other timezone (that's relatively easy) or is CEST your local timezone and for some reason you want to render your timestamps in IST timezone (which is usually a bad idea).

Re: How do i convert CEST to IST?

Joshi_18 — Tue, 25 Apr 2023 11:01:17 GMT

@PickleRick yes the second one which you said at the end

Re: How do i convert CEST to IST?

PickleRick — Tue, 25 Apr 2023 11:06:21 GMT

So the first answer is "don't do it at all". Because mixing timezones (especially if you don't give a very very clear indication of it) is only gonna confuse your users.

But I understand that in some - very rare - cases you might want to see what the given timestamp looks like in someone else's timezone (the obvious use case is if you interact with a person from another part of the globe in a multinational corpo). Then your only option is to "cheat" with this offsetting of the whole timestamp.

Re: How do i convert CEST to IST?

isoutamo — Tue, 25 Apr 2023 13:03:53 GMT

Or use option 3 on linked answer to change User's TZ on GUI preferences.

Re: How do i convert CEST to IST?

PickleRick — Tue, 25 Apr 2023 13:14:43 GMT

Sure, but that still won't let you see two timezones at the same time.