Hi , I have a scenario. where my _time is chicago time(CST/CDT) . But I need to convert it to London time and do statistics on the data. Is there any way that I can do it during the search time?
I thought to subtract difference in seconds between two regions. But the real issue is, I should also take the Daylight savings in to account. which makes time difference between two regions as a variable. Any query that satisfies this condition?
You can change your time zone in the settings of your spunk account with the current time zone wherever you are. This change will display your _time with the correct time zone . I believe your time zone settings in your user account is in CST at present for which u see _time as CST
The right way to do all this is to make sure that _time
for every single event inside of Splunk is always UTC (regardless of what the time/TZ format is inside of the event). If everything is that way, then you just need to change YOUR user's Time zone
setting in Your Name
-> Account settings
-> Time zone
to GMT. Then all of your Timepicker
values will do what they should (e.g. "yesterday" will be a GMT-based "yesterday").
Try like this
your current search | eval _time=strptime(strftime(_time,"%F %T")."GMT","%F %T%Z")
See this runanywhere sample
| gentimes start=-1 | eval _time=now() | table _time | eval currentTime=_time
| eval londonTime=strptime(strftime(_time,"%F %T")."GMT","%F %T%Z")
| convert ctime(*Time) timeformat="%F %T"