Can we convert the _time(which is chicago time) to London time during search time

[ankithreddy777]

Hi , I have a scenario. where my _time is chicago time(CST/CDT) . But I need to convert it to London time and do statistics on the data. Is there any way that I can do it during the search time?

I thought to subtract difference in seconds between two regions. But the real issue is, I should also take the Daylight savings in to account. which makes time difference between two regions as a variable. Any query that satisfies this condition?

[loveforsplunk]

You can change your time zone in the settings of your spunk account with the current time zone wherever you are. This change will display your _time with the correct time zone . I believe your time zone settings in your user account is in CST at present for which u see _time as CST

[woodcock]

The right way to do all this is to make sure that _time for every single event inside of Splunk is always UTC (regardless of what the time/TZ format is inside of the event). If everything is that way, then you just need to change YOUR user's Time zone setting in Your Name -> Account settings -> Time zone to GMT. Then all of your Timepicker values will do what they should (e.g. "yesterday" will be a GMT-based "yesterday").

[somesoni2]

Try like this

your current search | eval _time=strptime(strftime(_time,"%F %T")."GMT","%F %T%Z")

See this runanywhere sample

| gentimes start=-1 | eval _time=now() | table _time | eval currentTime=_time 
| eval londonTime=strptime(strftime(_time,"%F %T")."GMT","%F %T%Z")
| convert ctime(*Time) timeformat="%F %T"