I have this date/time format, I need to add 4 hours to each field, can it be possible?
if yes please help me
Thanks 😍
Ok, be a bit more specific what you want and why you want it because such time manipulation is quite often a sign of a try to manipulate timezones instead of changing actual time.
Anyway, to manipulate the time in any way, you firstly must parse it into a unix timestamp by using strptime, as @venky1544 already showed. Such parsed time will be rendered (if you use strftime or implicitly if the field is called _time) in your local timezone. Isn't it enough for you?
hi @Kisame27
try this hope it should help
|makeresults | eval _time= "2022-03-02T13:34:44.13Z"
|append [|makeresults | eval _time= "2022-03-02T07:34:05.727Z"]
|append [|makeresults | eval _time= "2022-03-02T08:16:10.203Z"]
|append [|makeresults | eval _time= "2022-03-02T06:44:19.867Z"]
|sort _time | eval reported_date = strptime(_time, "%Y-%m-%dT%H:%M:%S.%QZ") |eval newtime=reported_date+14400
|eval c_time=strftime(newtime,"%Y-%m-%dT%H:%M:%S.%QZ") |fields - newtime,reported_date