Getting Data In

How to convert GMT to EDT?

davidcraven02
Communicator

How could I convert this GMT time to EDT?

index="wineventlog" host=opdc* Account_Name=*test_user EventCode=4624 
| makemv Account_Name
| mvexpand Account_Name
| eval day=strftime(_time, "%d-%m-%y") 
| join type=left src_ip 
    [ search index=ad source=addnsscan earliest=-12h@h latest=now 
    | rename data as src_ip, name as hostname
    | fields src_ip, hostname] 
| stats earliest(_time) AS earliest by Account_Name, src_ip, hostname, day 
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S %Z")

alt text

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try
Updated

index="wineventlog" host=opdc* Account_Name=*test_user EventCode=4624 
 | makemv Account_Name
 | mvexpand Account_Name
 | eval day=strftime(_time, "%d-%m-%y") 
 | join type=left src_ip 
     [ search index=ad source=addnsscan earliest=-12h@h latest=now 
     | rename data as src_ip, name as hostname
     | fields src_ip, hostname] 
 | stats earliest(_time) AS earliest by Account_Name, src_ip, hostname, day 
| eval offset=strptime("00:00Z","%H:%M%Z")-strptime("00:00EDT","%H:%M%Z")
 | eval earliest=strftime(earliest+offset,"%d/%m/%Y %H.%M.%S %Z")
| fields - offset

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try
Updated

index="wineventlog" host=opdc* Account_Name=*test_user EventCode=4624 
 | makemv Account_Name
 | mvexpand Account_Name
 | eval day=strftime(_time, "%d-%m-%y") 
 | join type=left src_ip 
     [ search index=ad source=addnsscan earliest=-12h@h latest=now 
     | rename data as src_ip, name as hostname
     | fields src_ip, hostname] 
 | stats earliest(_time) AS earliest by Account_Name, src_ip, hostname, day 
| eval offset=strptime("00:00Z","%H:%M%Z")-strptime("00:00EDT","%H:%M%Z")
 | eval earliest=strftime(earliest+offset,"%d/%m/%Y %H.%M.%S %Z")
| fields - offset
0 Karma

davidcraven02
Communicator

Thank you for this but the earliest field is blank.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try the updated answer. Fixed a typo in first strptime in eval for offset.

0 Karma

davidcraven02
Communicator

Perfect thank you!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...