Convert timestamp from BST to EDT

[davidcraven02]

My approach was to subtract 5 hours (18000 seconds) from the timestamp but when using the below line I get no results.

| eval timestamp =  timestamp - 18000

Full Query without subtraction

index=duo extracted_eventtype=authentication integration="Microsoft RDP" username=*
| eval Time=strftime(timestamp, "%H:%M") 
| eval day=strftime(timestamp, "%Y-%m-%d") 
| stats earliest(Time) by day, username  
| rename earliest(Time) as LogonTime 
| table username, day, LogonTime  
| sort username

I included the timestamp in the table to show its format.

[renjith_nair · Accepted solution]

Try the substraction with the original time fields "_time" or convert it using strptime

     | eval BST_Time= _time - 18000

or use the relative_time function

|eval BST_Time=relative_time(_time,"-5h") 

[davidcraven02]

Thank you this worked.