Daylight Saving issue column

[harryvdtol]

Hello,

I have search for some old posting, but i did not find the proper answers.

In Splunk i have a column date field that is named PlanDate and looks like this.

31-10-2025T20:10:30
The format is this: DD-MM-YYYYTHH:MM:SS

But this field is in the wrong timezone.
My timezone is Amsterdam. When summertime starts i need to add 2 hours to this field and in wintertime one hour.

How do i do this?
Can this be done at search time, or do i need to do this on index-time?

I was thinking of making a lookup with daylight saving days for the next years, but i was hoping for a better solution

Regards,

Harry

[richgalloway]

To convert that UTC timestamp into local time, try this eval command

| eval PlanDate=strftime(strptime(PlanDate . "Z", "%d-%m-%YT%H:%M:%S%Z"))

Appending "Z" to the timestamp tells Splunk to treat it as UTC instead of local time.

[livehybrid]

Hi @harryvdtol 
I dont think it’s possible for Splunk to natively manage timestamp timezones for non _time fields, so what I would look at doing to solve this issue is to create an eval field to convert the planDate into epoch, then determine the amount of hours to add (if appropriate) and then convert back to human readable time string. You should be able to do this in a single eval and then use it to create an eval field so you get the field automatically at search time. 
Im not in front of Splunk at the moment to test this but if helps further I’d be happy to have a go at creating the full eval with an example. 

🌟Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[harryvdtol · Accepted solution]

Hi all,

I think i have manged your's input
I have made  two examples and they do what i want

| makeresults
| eval tz="Summer"
| eval PlanDate="15-06-2025T20:10:30"
| eval PlanDate_utc=PlanDate . "Z"
| eval PlanDate_utc_epoch=strptime(PlanDate_utc, "%d-%m-%YT%H:%M:%S%Z")
| eval PlanDate_utc_noepoch=strftime(PlanDate_utc_epoch, "%d-%m-%YT%H:%M:%S%Z")
| eval PlanDate_epoch=strptime(PlanDate, "%d-%m-%YT%H:%M:%S")
| eval diff=PlanDate_utc_epoch-PlanDate_epoch
| eval PlanDate_my_tz=PlanDate_epoch+diff
| eval PlanDate_my_tz=strftime(PlanDate_my_tz, "%d-%m-%YT%H:%M:%S")
| table tz PlanDate PlanDate_epoch PlanDate_utc_noepoch PlanDate_utc_epoch PlanDate_my_tz diff PlanDate_utc_noepoch

| makeresults
| eval tz="Winter"
| eval PlanDate="31-10-2025T20:10:30"
| eval PlanDate_utc=PlanDate . "Z"
| eval PlanDate_utc_epoch=strptime(PlanDate_utc, "%d-%m-%YT%H:%M:%S%Z")
| eval PlanDate_utc_noepoch=strftime(PlanDate_utc_epoch, "%d-%m-%YT%H:%M:%S%Z")
| eval PlanDate_epoch=strptime(PlanDate, "%d-%m-%YT%H:%M:%S")
| eval diff=PlanDate_utc_epoch-PlanDate_epoch
| eval PlanDate_my_tz=PlanDate_epoch+diff
| eval PlanDate_my_tz=strftime(PlanDate_my_tz, "%d-%m-%YT%H:%M:%S")
| table tz PlanDate PlanDate_epoch PlanDate_utc_noepoch PlanDate_utc_epoch PlanDate_my_tz diff PlanDate_utc_noepoch

Regards,

Harry

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.