I need to be able to determine if string time X is PST or PDT. My Splunk timezone is set to Pacific. How?
string time X
| makeresults | eval x="2019-03-10 10:30:00" | eval pst_epoch=strptime(x,"%Y-%m-%d %H:%M:%S") | eval pxt=strftime(pst_epoch,"%Z") | table pxt
Switch 3/10/19 to be 3/1/19 and you'll see the switch.
View solution in original post