Splunk Search

How to covert GMT Time(0-12:00) to PST time.

rajhemant26
New Member

My result is giving me the output for GMT time for the given time what I have defined.

Tags (1)
0 Karma

whrg
Motivator

Hello @rajhemant26,

If your events have an incorrect time zone, then I suggest you set the correct zone at index time using TIME_FORMAT or TZ in props.conf.

If your events have the correct time zone and you want to display them in your local time zone, then change the time zone in the user settings. (Click on your username at the top and then click on "Preferences".)

If you want to shift the time of your events at search time (I believe this is want you want), then do this:

index=dcsdjc ... | eval _time=_time-7*60*60 | ...

This will substract 7 hours from _time. It works because _time is represented as Unix epoch time.

However, it will not update the date_wday and date_hour fields.

So do this:

index=dcsdjc ... | eval _time=_time-7*60*60 | eval wday=strftime(_time,"%a") | eval hour=strftime(_time,"%H") | search hour>=0 ...
0 Karma

rajhemant26
New Member

@whrg thankyou so much for your help. but this is giving me for the entire week,
but I want to see the output only for weekdays ( Monday to Friday)

0 Karma

whrg
Motivator

Add this to the search above:

| search hour>=0 hour<=12 wday IN (Mon,Tue,Wed,Thu,Fri)

Or for numerical week days ("%w" instead of "%a"):

index=dcsdjc ... | eval _time=_time-7*60*60 | eval wday=strftime(_time,"%w") | eval hour=strftime(_time,"%H") | search hour>=0 hour<=12 wday>=1 wday<=5

Check out the documentation on Date and time format variables.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...