Getting Data In

How to add 4 hours to each field in this Date time format?

Kisame27
Explorer

Kisame27_0-1646229275934.png

I have this date/time format, I need to add 4 hours to each field, can it be possible?

if yes please help me

Labels (1)
Tags (2)
0 Karma
1 Solution

venky1544
Builder

Hi @Kisame27 

if this solution helped can you please accept it 

it might help others as well 

 

View solution in original post

Kisame27
Explorer

Thanks  😍

0 Karma

venky1544
Builder

Hi @Kisame27 

if this solution helped can you please accept it 

it might help others as well 

 

PickleRick
SplunkTrust
SplunkTrust

Ok, be a bit more specific what you want and why you want it because such time manipulation is quite often a sign of a try to manipulate timezones instead of changing actual time.

Anyway, to manipulate the time in any way, you firstly must parse it into a unix timestamp by using strptime, as @venky1544 already showed. Such parsed time will be rendered (if you use strftime or implicitly if the field is called _time) in your local timezone. Isn't it enough for you?

venky1544
Builder

hi @Kisame27 

try this hope it should help 

|makeresults | eval _time= "2022-03-02T13:34:44.13Z"
|append [|makeresults | eval _time= "2022-03-02T07:34:05.727Z"]
|append [|makeresults | eval _time= "2022-03-02T08:16:10.203Z"]
|append [|makeresults | eval _time= "2022-03-02T06:44:19.867Z"]
|sort _time | eval reported_date = strptime(_time, "%Y-%m-%dT%H:%M:%S.%QZ") |eval newtime=reported_date+14400
|eval c_time=strftime(newtime,"%Y-%m-%dT%H:%M:%S.%QZ") |fields - newtime,reported_date

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...