Splunk Search

Change Date Format Display

togmolodon
Explorer

Hi,

I just want to change the displayed date format from 2014-04-03T23:00:00.000Z to 2014-04-03 19:00 i.e., convert from Zulu to GMT-4 using the date field.

I can't seem to figure this one out.

Many thanks!

Tags (2)
0 Karma
1 Solution

togmolodon
Explorer

@martin_mueller
Changing the timezone via settings is not an option for me, thanks though for your insight.

@linu1988
I am getting an error when I tried yours, thanks anyways.

FYI, I was able to make it work using the following:

eval epochtime = strptime(date,"%FT%H:%M:%S.%3Q")-14400 | eval "Revised" = strftime(epochtime, "%F %H:%M %p") | table Revised

View solution in original post

togmolodon
Explorer

@martin_mueller
Changing the timezone via settings is not an option for me, thanks though for your insight.

@linu1988
I am getting an error when I tried yours, thanks anyways.

FYI, I was able to make it work using the following:

eval epochtime = strptime(date,"%FT%H:%M:%S.%3Q")-14400 | eval "Revised" = strftime(epochtime, "%F %H:%M %p") | table Revised

linu1988
Champion

i thought you had your default timeforamt in _time field!! Btw good that you have done it.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can set the timezone for your user to GMT-4: SplunkBar -> Username -> Edit Account -> Timezone
That will make Splunk render all timestamps, including custom strftime() outputs, as GMT-4. It won't affect _raw text of course.

0 Karma

linu1988
Champion
|eval _time=_time-(4*3600)|convert  timeformat="%y-%m-%d %H:%M" ctime(_time)
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...