topic Re: Time format conversion from UTC to SGT time in Splunk Search

Time format conversion from UTC to SGT time

NitishUa — Mon, 23 Oct 2023 05:45:41 GMT

Hi Team,

I'm currently receiving AWS CloudWatch logs in Splunk using the add-on. I'm developing a use case and need to utilize the "event Time" field from the logs. I require assistance in converting the event Time from UTC to SGT.

Sample event Time is in UTC +0

2023-06-30T17:17:52Z

2023-06-30T21:29:53Z

2023-06-30T22:32:53Z

2023-07-01T00:38:53Z

2023-07-01T04:50:52Z

2023-07-01T05:53:55Z

2023-07-01T06:56:54Z

2023-07-01T07:59:52Z

2023-07-01T09:02:56Z

2023-07-01T10:05:54Z

2023-07-01T11:08:53Z

2023-07-01T12:11:53Z

End result: UTC + 0 to SGT + 8 time.

Expected output format is "%Y-%m-%d %H:%M:%S"

Re: Time format conversion from UTC to SGT time

gcusello — Mon, 23 Oct 2023 06:05:58 GMT

Sorry,

but SGT+8 corresponds to UTC.

If you want to chenge the time format from the displayed to "%Y-%m-%d %H:%M:%S" you should use eval with the time functions:

| eval Time=strftime(_time,"%Y-%m-%d %H:%M:%S")

Ciao.

Giuseppe

Re: Time format conversion from UTC to SGT time

NitishUa — Mon, 23 Oct 2023 06:29:06 GMT

Will this change the timezone in the output to SGT?

We want the output to be shifted to SGT and then formatted to "%Y-%m-%d %H:%M:%S"