How to change timezone of a timestamp in results of search?

[tyhopping1]

I have created a query that tracks the Start and End Time of a given job. These start and end times are calculated by taking the earliest timestamp(StartTime) and latest timestamp(EndTime).

Currently the timestamps, and in turn Start/End times, are in GMT. However, I need the Start/End Time to be returned in CT within the results of the search.

Here is my query:

NameOfJob = JOBNAME| spath timestamp | search timestamp=*
| eval day = strftime(_time, "%Y-%m-%d") 
| stats min(timestamp) as StartTimeEpoch, max(timestamp) as EndTimeEpoch by NameOfJob day 
| eval StartTimeEpoch=strptime(StartTimeEpoch, "%Y-%m-%dT%H:%M:%S")
| eval EndTimeEpoch=strptime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S")
| eval duration=(EndTimeEpoch-StartTimeEpoch) | eval minutes = duration/60 | eval hours = minutes/60
| eval StartTimeEpochD = strftime(StartTimeEpoch,"%Y-%m-%dT%H:%M:%S")
| eval EndTimeEpochD = strftime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S")
| sort by StartTimeEpochD

Any help is appreciated. Thank you

[mayurr98]

CT is 6 hours behind the GMT. So you would need minus the 6 hours from GMT

try this:

NameOfJob = JOBNAME 
| spath timestamp 
| search timestamp=* 
| eval day = strftime(_time, "%Y-%m-%d") 
| stats min(timestamp) as StartTimeEpoch, max(timestamp) as EndTimeEpoch by NameOfJob day 
| eval StartTimeEpoch=strptime(StartTimeEpoch, "%Y-%m-%dT%H:%M:%S") 
| eval EndTimeEpoch=strptime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S") 
| eval duration=(EndTimeEpoch-StartTimeEpoch) 
| eval minutes = duration/60 
| eval hours = minutes/60 
| eval StartTimeEpoch=StartTimeEpoch-21600 
| eval EndTimeEpoch=EndTimeEpoch-21600 
| eval StartTimeEpochD_CT = strftime(StartTimeEpoch,"%Y-%m-%dT%H:%M:%S") 
| eval EndTimeEpochD_CT = strftime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S") 
| sort by StartTimeEpochD_CT