Timezone

[Khuzair81]

How to convert the below the time field from GMT to EST. 

time=Jun 7, 2021 10:24:33 AM GMT

i tried below

| eval t=strftime(strptime(time, "%m %d, %y %H:%M:%S %Z"), "%H:%M:%S")

I'm not getting the result

[Khuzair81]

@richgalloway i want to get the data only from yesterday is there anyway to write it in Query

Can i use  | where Date=-1d@d

[richgalloway]

This should be a new posting, but, yes, you can do that, however not using where.  To search only yesterday, use the earliest and latest options to the search command.

index=foo earliest=-1d@d latest=@d

[richgalloway · Accepted solution]

The strptime format string doesn't match the sample time string.  Try this

| eval t=strftime(strptime(time, "%b %d, %y %H:%M:%S %p %Z"), "%H:%M:%S")