topic Re: Add a number of hours to a search field in Splunk Search

Add a number of hours to a search field?

balcv — Mon, 08 May 2023 10:07:04 GMT

I have a field returned with some search data that contains a date and time in UTC. I would like to be able to add 10 hours to the time.

a) Field contents(dateTime UTC): 2023-05-08T00:24:37.6079338Z

b) New field (Local dateTime): 2023-05-08 10:24:37.607

Is there a way to do the conversion from a) to b) in the search syntax?

scelikok — Mon, 08 May 2023 05:03:37 GMT

You can use below;

| eval newtime=strftime(strptime(datefield,"%Y-%m-%dT%H:%M:%S.%7QZ")+36000,"%Y-%m-%dT%H:%M:%S.%3QZ")

balcv — Mon, 08 May 2023 05:23:43 GMT

Perfect thanks @scelikok