Getting Data In

How to add 4 hours to each field in this Date time format?

Kisame27
Explorer

Kisame27_0-1646229275934.png

I have this date/time format, I need to add 4 hours to each field, can it be possible?

if yes please help me

Labels (1)
Tags (2)
0 Karma
1 Solution

venky1544
Builder

Hi @Kisame27 

if this solution helped can you please accept it 

it might help others as well 

 

View solution in original post

Kisame27
Explorer

Thanks  😍

0 Karma

venky1544
Builder

Hi @Kisame27 

if this solution helped can you please accept it 

it might help others as well 

 

PickleRick
SplunkTrust
SplunkTrust

Ok, be a bit more specific what you want and why you want it because such time manipulation is quite often a sign of a try to manipulate timezones instead of changing actual time.

Anyway, to manipulate the time in any way, you firstly must parse it into a unix timestamp by using strptime, as @venky1544 already showed. Such parsed time will be rendered (if you use strftime or implicitly if the field is called _time) in your local timezone. Isn't it enough for you?

venky1544
Builder

hi @Kisame27 

try this hope it should help 

|makeresults | eval _time= "2022-03-02T13:34:44.13Z"
|append [|makeresults | eval _time= "2022-03-02T07:34:05.727Z"]
|append [|makeresults | eval _time= "2022-03-02T08:16:10.203Z"]
|append [|makeresults | eval _time= "2022-03-02T06:44:19.867Z"]
|sort _time | eval reported_date = strptime(_time, "%Y-%m-%dT%H:%M:%S.%QZ") |eval newtime=reported_date+14400
|eval c_time=strftime(newtime,"%Y-%m-%dT%H:%M:%S.%QZ") |fields - newtime,reported_date

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...