Splunk Search

Convert Epoch Time to a different timezone using SPL

jason_hotchkiss
Communicator

I have the follow time:

EPOCH HUMAN READABLE

170363091912/26/2023 19:48:39


I would like to convert the EPOCH to CST time.

Currently I am testing the following, but I am curious to know if there is an easier way.

 

 

| makeresults
| eval _time = 1703630919
| eval cst_offset = "06:00"
| convert ctime(_time) as utc_time timeformat="%H:%M"
| eval utc_time = strptime(utc_time,"%H:%M")
| eval cst_offset = strptime(cst_offset,"%H:%M")
| eval cst_time = (utc_time - cst_offset)
| convert ctime(cst_time) as cst_time timeformat="%H:%M"."CST"
| convert ctime(utc_time) as utc_time timeformat="%H:%M"."UTC"

 

 

Results in:

_timecst_offsetcst_timeutc_time
2023-12-26 19:48:391703667600.00000016:48.CST22:48.UTC



Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
You could set TZ on GUI. Modify user preference with selecting correct TZ.
r. Ismo
0 Karma

jason_hotchkiss
Communicator

Yes, I could.  However, this is going to be a report, and for a different timezone.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Unfortunately there is no function to do this kind of action. Basically you could do your own command to do it, but probably easier way is use e.g. lookup which contains offsets and then macro which return that value based on utc time + offset calculation.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...