How to convert Epoch to UTC timestamp?

[snehasal]

Hi

I am setting a time token "WFDate_tok_display1" which has timestamp value from the user click. The report shows Date as 18th July. however when I extract it using strftime(), it shows the time in PST (my local time) whereas the original time showed in Splunk events (i.e _time) is in UTC.

<drilldown>
            <set token="WFDate_tok_display">$click.value$</set>
            <eval token="WFDate_tok_display1">strftime(WFDate_tok_display,"%m/%d/%y")</eval>
</drilldown>

<panel>
        <title>Runtime for on $WFDate_tok_display2$ 
          between $WFDate_tok$ and $WFDate_tok1$ </title>
</panel>

Please help in converting this timestamp to UTC.

Thanks,
Sneha Salvi

[splunkyj]

Great tip DalJeanis

[DalJeanis]

Splunk defaults to presenting in your own time. You can change your user settings to where everything appears in UTC, or you can format the time explicitly into UTC by using %Z.

strftime(WFDate_tok_display,"%m/%d/%y %Z")

If that doesn't work (and it should) then here's a link to where a guy posted a macro to force into UTC - https://answers.splunk.com/answers/41585/display-time-in-utc.html

---

By the way, you will save yourself hordes of grief if you get into the habit of presenting dates like this -

strftime(WFDate_tok_display,"%Y-%m-%d %Z")

If you do that, then you will always be able to sort by the formatted date, or subset the year or month without further calculation.