Time stamp format to round to nearest hour GMT Timezone

[Sammy13]

I have a start time column in splunk in this format:
19:10:54:19
I have a start date column in this format: 2022-11-15
I also have a time zone column in this format: -500

How can I get a new column with time rounded up to the next hour, in GMT.
Example of output: Mon Mar 21 18:00:00 GMT 2022

Thanks!

[Sammy13]

Thanks a lot will apply and see if it works 

[richgalloway]

If you put the three fields together into a single string then you can use strptime, relative_time, and strftime to do the job.  Note that Splunk always displays timestamps in the user's selected time zone.  There is no way to force GMT (or any other time zone).

See if this helps.

| eval timestamp=start_date . " " . start_time . time_zone
| eval epoch = strptime(timestamp, "%Y-%m-%d %H:%M:%S:%2N%z")
| eval display_string = strftime(relative_time(epoch,"+1h@h"), "%a %b %d %H:%M:%S %Z %Y")