Splunk Search

Change Date Format Display

togmolodon
Explorer

Hi,

I just want to change the displayed date format from 2014-04-03T23:00:00.000Z to 2014-04-03 19:00 i.e., convert from Zulu to GMT-4 using the date field.

I can't seem to figure this one out.

Many thanks!

Tags (2)
0 Karma
1 Solution

togmolodon
Explorer

@martin_mueller
Changing the timezone via settings is not an option for me, thanks though for your insight.

@linu1988
I am getting an error when I tried yours, thanks anyways.

FYI, I was able to make it work using the following:

eval epochtime = strptime(date,"%FT%H:%M:%S.%3Q")-14400 | eval "Revised" = strftime(epochtime, "%F %H:%M %p") | table Revised

View solution in original post

togmolodon
Explorer

@martin_mueller
Changing the timezone via settings is not an option for me, thanks though for your insight.

@linu1988
I am getting an error when I tried yours, thanks anyways.

FYI, I was able to make it work using the following:

eval epochtime = strptime(date,"%FT%H:%M:%S.%3Q")-14400 | eval "Revised" = strftime(epochtime, "%F %H:%M %p") | table Revised

linu1988
Champion

i thought you had your default timeforamt in _time field!! Btw good that you have done it.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can set the timezone for your user to GMT-4: SplunkBar -> Username -> Edit Account -> Timezone
That will make Splunk render all timestamps, including custom strftime() outputs, as GMT-4. It won't affect _raw text of course.

0 Karma

linu1988
Champion
|eval _time=_time-(4*3600)|convert  timeformat="%y-%m-%d %H:%M" ctime(_time)
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...