Converting Military time to Standard time

[fmpa_isaac]

Hello, I am trying to convert my _time field from Military time to Standard time. Example:L 2016-04-21 21:47:38.

So far, none of the question and answers have provided any help. Thank you

[javiergn]

Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?
Unanswered questions make me sad 😞

[javiergn]

I would probably use a lookup to translate those military time letters into UTC offsets.
For instance, if you create a lookup named militaryTimeLookup based on the following CSV:

TZ,Letter,Offset
Alpha Time Zone,A,0100
Bravo Time Zone,B,0200
Charlie Time Zone,C,0300
Delta Time Zone,D,0400
Echo Time Zone,E,0500
Foxtrot Time Zone,F,0600
Golf Time Zone,G,0700
Hotel Time Zone,H,0800
India Time Zone,I,0900
Kilo Time Zone,K,1000
Lima Time Zone,L,1100
Mike Time Zone,M,1200
November Time Zone,N,-0100
Oscar Time Zone,O,-0200
Papa Time Zone,P,-0300
Quebec Time Zone,Q,-0400
Romeo Time Zone,R,-0500
Sierra Time Zone,S,-0600
Tango Time Zone,T,-0700
Uniform Time Zone,U,-0800
Victor Time Zone,V,-0900
Whiskey Time Zone,W,-1000
X-ray Time Zone,X,-1100
Yankee Time Zone,Y,-1200
Zulu Time Zone,Z,0000

You could do something like:

| stats count
| fields - count
| eval military_time = "L 2016-04-21 21:47:38"
| rex field=military_time "^(?<Letter>[A-Z]) (?<Time>.+)$"
| lookup militaryTimeLookup Letter OUTPUT Offset
| eval standard_time = Time + " " + Offset
| eval standard_time_epoch = strptime(standard_time, "%Y-%m-%d %H:%M:%S %z")

[sundareshr]

_time is a special field in Splunk whose actual value is in epoch format but displayed in human readable format. To change the format, you can use 'strftime()` function and pass in the appropriate derivatives from here http://strftime.org/. So for standard time you could use

| eval _time=strftime(_time, "%Y-%m-%d %I%M%S %p")