Splunk Search

API: How to specify returning dates with a UTC or GMT offset rather than a CDT time zone?

Path Finder

How can I specify Splunk to return dates with a UTC or GMT offset rather than a time zone abbreviation?
Right now I get back information like this:

{"preview":false,"offset":31,"result":{"_time":"2019-06-17 17:30:00.000 CDT","Value":"97.038000"}}

I would like to have a UTC offset instead of the time zone abbreviation CDT.

Any clues?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@artrune ,

You can use %z in the time format

Reference : https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Commontimeformatvariables#Time_va...
E.g.

|eval formatted=strftime(_time,"%d-%m-%Y %H:%M:%S %z")

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@artrune ,

You can use %z in the time format

Reference : https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Commontimeformatvariables#Time_va...
E.g.

|eval formatted=strftime(_time,"%d-%m-%Y %H:%M:%S %z")

View solution in original post

0 Karma

Path Finder

Thanks for the answer, this helped alot, However is there a way for _time to assume that value? Because if not it creates an extra variable called formatted that contains the formatted date.
I would like a workaround but if not possible I can live with that.
I will try renaming in the mean time and see what happens

0 Karma

SplunkTrust
SplunkTrust

@artrune , yes you can directly assign the converted values to _time instead of an extra variable ,

|eval _time=strftime(_time,"%d-%m-%Y %H:%M:%S %z")

However, its advised not to change _time, especially if you are using it for any other operation in the search.

0 Karma