How to add 4 hours to each field in this Date time format?

[Kisame27]

I have this date/time format, I need to add 4 hours to each field, can it be possible?

if yes please help me

[Kisame27]

Thanks  😍

[venky1544 · Accepted solution]

Hi @Kisame27 

if this solution helped can you please accept it 

it might help others as well 

[PickleRick]

Ok, be a bit more specific what you want and why you want it because such time manipulation is quite often a sign of a try to manipulate timezones instead of changing actual time.

Anyway, to manipulate the time in any way, you firstly must parse it into a unix timestamp by using strptime, as @venky1544 already showed. Such parsed time will be rendered (if you use strftime or implicitly if the field is called _time) in your local timezone. Isn't it enough for you?

[venky1544]

hi @Kisame27 

try this hope it should help 

|makeresults | eval _time= "2022-03-02T13:34:44.13Z"
|append [|makeresults | eval _time= "2022-03-02T07:34:05.727Z"]
|append [|makeresults | eval _time= "2022-03-02T08:16:10.203Z"]
|append [|makeresults | eval _time= "2022-03-02T06:44:19.867Z"]
|sort _time | eval reported_date = strptime(_time, "%Y-%m-%dT%H:%M:%S.%QZ") |eval newtime=reported_date+14400
|eval c_time=strftime(newtime,"%Y-%m-%dT%H:%M:%S.%QZ") |fields - newtime,reported_date