how to convert datetime from UTC to ET in search results

[dhavamanis]

we have indexed data in UTC format and want to display in the search results stats as ET zone. Can you please provide some example.

index="myindex" earliest=-24h latest=now| stats count by date_month,date_mday,date_hour | sort count desc

In the above query giving results in UTC format results and we want to convert show as ET zone.

[somesoni2 · Accepted solution]

Assuming your local timezone is UTC (as the search results displays it). Try this

index=myindex earliest=-24h latest=now | eval EST_time=strptime(strftime(_time,"%m/%d/%Y %H:%M:%S EST"),"%m/%d/%Y %H:%M:%S %Z") | eval date_month=strftime(EST_time,"%m") | eval date_mday=strftime(EST_time,"%d") | eval date_hour=strftime(EST_time,"%H")| stats count by date_month,date_mday,date_hour | sort count desc