Getting Data In

Convert GMT to CST timezone

ravir_jbp
Explorer

I am trying to conver the GMT time to CST time. I am able to get the desire data using below query. Now I am looking for query to convert GMT time to CST.

 

index=test AcdId="*" AgentId="*" AgentLogon="*" chg="*" seqTimestamp"*" currStateStart="*" currActCodeOid="*" currActStart="*" schedActCodeOid="*" schedActStart="*" nextActCodeOid="*" nextActStart="*" schedDate="*" adherenceStart="*" acdtimediff="*"
| eval seqTimestamp=replace(seqTimestamp,"^(.+)T(.+)Z$","\1 \2")
| eval currStateStart=replace(currStateStart,"^(.+)T(.+)Z$","\1 \2")
| eval currActStart=replace(currActStart,"^(.+)T(.+)Z$","\1 \2")
| eval schedActStart=replace(schedActStart,"^(.+)T(.+)Z$","\1 \2")
| eval nextActStart=replace(nextActStart,"^(.+)T(.+)Z$","\1 \2")
| eval adherenceStart=replace(adherenceStart,"^(.+)T(.+)Z$","\1 \2")
| table AcdId, AgentId, AgentLogon, chg, seqTimestamp,seqTimestamp1, currStateStart, currActCodeOid, currActStart, schedActCodeOid, schedActStart, nextActCodeOid, nextActStart, schedDate, adherenceStart, acdtimediff

Below are the results I am getting:

image.JPG

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

To add to @ITWhisperer 's answer - Splunk processes timestamp as "unix timestamps" - integers containing number of seconds since epoch. As such, timestamp is "timezoneless", it's just rendered when needed into a string, possibly containing a timezone description. But timestamp is always (when rendered automatically by WebUI or explicitly when strftime is called) rendered in user's timezone (the one set in user's preferences).

So while with strptime you can read and apply the timezone offset from the string representation of a given point in time, strftime doesn't let you specify the timezone freely.

The only thing you can do is "cheat" a bit by manually adjusting the timezone with the offset to another timezone and render it in your local timezone but without displaying said timezone.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to add (or subtract) the timezone offset from the times. To do this, you  should parse the time strings to epoch datetimes with strptime(), change the time appropriately, and then reformat them with strftime().

0 Karma

ravir_jbp
Explorer

Hello @ITWhisperer  can you give me one example on how to convert that

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval curActStart=strftime(strptime(curActStart,"%F %T.%S")+(60*60*5)+(60*30),"%F %T.%S")
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...