How to convert timestamp to date and time with timezone?

[Sammy13]

Hi, I have a field with timestamp value "2017-09-21T20:00:00" in format. I need to convert it to the  date and time with time zone  For example, Thu Jul 18 09:30:00 PDT 2022 please do help thanks 

[liuce1]

| makeresults
| eval field1="2022-08-27T02:00:00"
| eval field2=strptime(field1,"%Y-%m-%dT%H:%M:%S")
| eval field3=relative_time(field2,"+8h")
| eval field4=strftime(field3,"%a %b %d %H:%M:%S.%Z %Y")
| table field1 field2 field3 field4

liuce1_2-1661568905705.png

First , using "strptime" function to transform String time "2022-08-27T02:00:00" to Unix timestamp field2 base on my time zone( My time zone setting is UTC+8, Splunk consider the time zone of String time as UTC+8,  so the Unix timestamp value is 1661536800). You can check your time zone setting as below.

liuce1_0-1661568673438.pngliuce1_1-1661568722578.png

Second,  I know the time zone of String time is UTC not UTC+8,  so I use "relative_time" function to add 8 hous to field2 , then I get field3

Finally, using "strftime" function to transform Unix timestamp to human readable format field 4

The date and time format variables I used ,  you can find them in this link

Date and time format variables - Splunk Documentation

Hope my answer can help you.

[Sammy13]

2017-09-21T20:48:48.535427Z this is the sample timestamp and I have rounded it to  hour like 2017-09-21T20:00:00 now I want to convert it to human readable format as mentioned above may be what I am doing may be wrong I am still learning splunk

[efavreau]

@Sammy13 
is there really a "T" in there, or is that a typo? Can you show us an actual log entry? obfuscate any sensitive data