Getting Data In

How to convert GMT to EDT?

Communicator

How could I convert this GMT time to EDT?

index="wineventlog" host=opdc* Account_Name=*test_user EventCode=4624 
| makemv Account_Name
| mvexpand Account_Name
| eval day=strftime(_time, "%d-%m-%y") 
| join type=left src_ip 
    [ search index=ad source=addnsscan earliest=-12h@h latest=now 
    | rename data as src_ip, name as hostname
    | fields src_ip, hostname] 
| stats earliest(_time) AS earliest by Account_Name, src_ip, hostname, day 
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S %Z")

alt text

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Give this a try
Updated

index="wineventlog" host=opdc* Account_Name=*test_user EventCode=4624 
 | makemv Account_Name
 | mvexpand Account_Name
 | eval day=strftime(_time, "%d-%m-%y") 
 | join type=left src_ip 
     [ search index=ad source=addnsscan earliest=-12h@h latest=now 
     | rename data as src_ip, name as hostname
     | fields src_ip, hostname] 
 | stats earliest(_time) AS earliest by Account_Name, src_ip, hostname, day 
| eval offset=strptime("00:00Z","%H:%M%Z")-strptime("00:00EDT","%H:%M%Z")
 | eval earliest=strftime(earliest+offset,"%d/%m/%Y %H.%M.%S %Z")
| fields - offset

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Give this a try
Updated

index="wineventlog" host=opdc* Account_Name=*test_user EventCode=4624 
 | makemv Account_Name
 | mvexpand Account_Name
 | eval day=strftime(_time, "%d-%m-%y") 
 | join type=left src_ip 
     [ search index=ad source=addnsscan earliest=-12h@h latest=now 
     | rename data as src_ip, name as hostname
     | fields src_ip, hostname] 
 | stats earliest(_time) AS earliest by Account_Name, src_ip, hostname, day 
| eval offset=strptime("00:00Z","%H:%M%Z")-strptime("00:00EDT","%H:%M%Z")
 | eval earliest=strftime(earliest+offset,"%d/%m/%Y %H.%M.%S %Z")
| fields - offset

View solution in original post

0 Karma

Communicator

Thank you for this but the earliest field is blank.

0 Karma

SplunkTrust
SplunkTrust

Try the updated answer. Fixed a typo in first strptime in eval for offset.

0 Karma

Communicator

Perfect thank you!!

0 Karma