API: How to specify returning dates with a UTC or GMT offset rather than a CDT time zone?

[artrune]

How can I specify Splunk to return dates with a UTC or GMT offset rather than a time zone abbreviation?
Right now I get back information like this:

{"preview":false,"offset":31,"result":{"_time":"2019-06-17 17:30:00.000 CDT","Value":"97.038000"}}

I would like to have a UTC offset instead of the time zone abbreviation CDT.

Any clues?

[renjith_nair · Accepted solution]

@artrune ,

You can use %z in the time format

Reference : https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Commontimeformatvariables#Time_va...
E.g.

|eval formatted=strftime(_time,"%d-%m-%Y %H:%M:%S %z")

[artrune]

Thanks for the answer, this helped alot, However is there a way for _time to assume that value? Because if not it creates an extra variable called formatted that contains the formatted date.
I would like a workaround but if not possible I can live with that.
I will try renaming in the mean time and see what happens

[renjith_nair]

@artrune , yes you can directly assign the converted values to _time instead of an extra variable ,

|eval _time=strftime(_time,"%d-%m-%Y %H:%M:%S %z")

However, its advised not to change _time, especially if you are using it for any other operation in the search.