Getting Data In

How to get non-abbreviated time-zone?

Is there a way to display the full timezone and not just the abbreviation? The SPL I am currently using is:

| eval zone=strftime(time(),"%Z %z") 

However this just gives me the abbreviation (i.e. "AEST +1000"). I would like it to display "Australian Eastern Standard Time +1000".

0 Karma
1 Solution

Path Finder

Moderator
Moderator

Hi @georgiawebber

I am the Community Content Specialist for Splunk Answers. If any of the answers worked for you please go ahead and accept it, if not let the community know if you need more clarification.

Thanks

0 Karma

Oops! Sorry I forgot I had this question out there. Have now accepted!

0 Karma

Builder

If it's consistently like in your question, here's a run anywhere example that everytime the zone field start with "AEST", it will replace it with "Australian Eastern Standard Time".

| makeresults
| eval zone=strftime(time(),"%Z %z")
| rex mode=sed field=zone "s/^(AEST)/Australian Eastern Standard Time/"

The makeresults command is simply to get it to work as an example, but what you need after your eval statement, is the third line.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

Builder

@georgiawebber Did this solution work for you? Did you need to clarify your question? Please remember to accept the answer that helped, or clarify your question/comment on the answers that are close.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

Esteemed Legend