Getting Data In

How to add 4 hours to each field in this Date time format?

Kisame27
Explorer

Kisame27_0-1646229275934.png

I have this date/time format, I need to add 4 hours to each field, can it be possible?

if yes please help me

Labels (1)
Tags (2)
0 Karma
1 Solution

venky1544
Builder

Hi @Kisame27 

if this solution helped can you please accept it 

it might help others as well 

 

View solution in original post

Kisame27
Explorer

Thanks  😍

0 Karma

venky1544
Builder

Hi @Kisame27 

if this solution helped can you please accept it 

it might help others as well 

 

PickleRick
SplunkTrust
SplunkTrust

Ok, be a bit more specific what you want and why you want it because such time manipulation is quite often a sign of a try to manipulate timezones instead of changing actual time.

Anyway, to manipulate the time in any way, you firstly must parse it into a unix timestamp by using strptime, as @venky1544 already showed. Such parsed time will be rendered (if you use strftime or implicitly if the field is called _time) in your local timezone. Isn't it enough for you?

venky1544
Builder

hi @Kisame27 

try this hope it should help 

|makeresults | eval _time= "2022-03-02T13:34:44.13Z"
|append [|makeresults | eval _time= "2022-03-02T07:34:05.727Z"]
|append [|makeresults | eval _time= "2022-03-02T08:16:10.203Z"]
|append [|makeresults | eval _time= "2022-03-02T06:44:19.867Z"]
|sort _time | eval reported_date = strptime(_time, "%Y-%m-%dT%H:%M:%S.%QZ") |eval newtime=reported_date+14400
|eval c_time=strftime(newtime,"%Y-%m-%dT%H:%M:%S.%QZ") |fields - newtime,reported_date

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...