Archive

Converting Military time to Standard time

fmpa_isaac
Path Finder

Hello, I am trying to convert my _time field from Military time to Standard time. Example:L 2016-04-21 21:47:38.

So far, none of the question and answers have provided any help. Thank you

Tags (1)
0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?
Unanswered questions make me sad 😞

0 Karma

javiergn
SplunkTrust
SplunkTrust

I would probably use a lookup to translate those military time letters into UTC offsets.
For instance, if you create a lookup named militaryTimeLookup based on the following CSV:

TZ,Letter,Offset
Alpha Time Zone,A,0100
Bravo Time Zone,B,0200
Charlie Time Zone,C,0300
Delta Time Zone,D,0400
Echo Time Zone,E,0500
Foxtrot Time Zone,F,0600
Golf Time Zone,G,0700
Hotel Time Zone,H,0800
India Time Zone,I,0900
Kilo Time Zone,K,1000
Lima Time Zone,L,1100
Mike Time Zone,M,1200
November Time Zone,N,-0100
Oscar Time Zone,O,-0200
Papa Time Zone,P,-0300
Quebec Time Zone,Q,-0400
Romeo Time Zone,R,-0500
Sierra Time Zone,S,-0600
Tango Time Zone,T,-0700
Uniform Time Zone,U,-0800
Victor Time Zone,V,-0900
Whiskey Time Zone,W,-1000
X-ray Time Zone,X,-1100
Yankee Time Zone,Y,-1200
Zulu Time Zone,Z,0000

You could do something like:

| stats count
| fields - count
| eval military_time = "L 2016-04-21 21:47:38"
| rex field=military_time "^(?<Letter>[A-Z]) (?<Time>.+)$"
| lookup militaryTimeLookup Letter OUTPUT Offset
| eval standard_time = Time + " " + Offset
| eval standard_time_epoch = strptime(standard_time, "%Y-%m-%d %H:%M:%S %z")
0 Karma

sundareshr
Legend

_time is a special field in Splunk whose actual value is in epoch format but displayed in human readable format. To change the format, you can use 'strftime()` function and pass in the appropriate derivatives from here http://strftime.org/. So for standard time you could use

| eval _time=strftime(_time, "%Y-%m-%d %I%M%S %p")
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!