https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244893#M72948 <P>Could you post your current search? Is the data from CSV being ingested to Splunk OR being used as lookup table OR direct csv access (inputcsv)?</P> Wed, 06 Jul 2016 15:50:38 GMT somesoni2 2016-07-06T15:50:38Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244892#M72947 <P>I'm fetching the data from a CSV file, but the issue with my data is that some of the values are in PDT and some are in PST. </P> <P>The format is <CODE>2016-06-15 04:55 PM PDT</CODE>. I just want all these values to be of same zone minus the time zone at the end. I want to display my data over a timechart.</P> Wed, 06 Jul 2016 13:26:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244892#M72947 PRIYANKA_1993 2016-07-06T13:26:37Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244893#M72948 <P>Could you post your current search? Is the data from CSV being ingested to Splunk OR being used as lookup table OR direct csv access (inputcsv)?</P> Wed, 06 Jul 2016 15:50:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244893#M72948 somesoni2 2016-07-06T15:50:38Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244894#M72949 <P>I am using inputlookup</P> Thu, 07 Jul 2016 01:21:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244894#M72949 PRIYANKA_1993 2016-07-07T01:21:03Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244895#M72950 <P>Hope this can help:</P> <PRE><CODE>|inputlookup xxx.csv | eval _time=strptime(your_time_field,"%Y-%m-%d %H:%M %p %Z") | timechart span=5m count </CODE></PRE> <P>the display time zone will be the user time zone, same as server time zone by default<BR /> the time format could be found in<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Commontimeformatvariables">http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Commontimeformatvariables</A></P> Thu, 07 Jul 2016 02:24:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244895#M72950 chanmi2 2016-07-07T02:24:41Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244896#M72951 <P>For some strange reason it is not showing any results.</P> Thu, 07 Jul 2016 05:01:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244896#M72951 PRIYANKA_1993 2016-07-07T05:01:46Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244897#M72952 <P>could you remove |timechart span=5m count, and check if the _time is parsed correctly?</P> Thu, 07 Jul 2016 06:00:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244897#M72952 chanmi2 2016-07-07T06:00:53Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244898#M72953 <P>After I changed the name of my time field, _time is getting parsed. </P> Fri, 08 Jul 2016 14:26:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244898#M72953 PRIYANKA_1993 2016-07-08T14:26:29Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244899#M72954 <P>Try this </P> <PRE><CODE>| inputlookup xxx.csv | eval time=strptime(your_time_field,"%Y-%m-%d %H:%M %p %Z") | bin span=15m time | stats count by time | eval time=strftime(time, "%c") </CODE></PRE> Fri, 08 Jul 2016 14:29:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-the-timezone-from-my-field-in-a-CSV-file/m-p/244899#M72954 sundareshr 2016-07-08T14:29:33Z