Convert Epoch Time to a different timezone using SPL

[jason_hotchkiss]

I have the follow time:

EPOCH HUMAN READABLE

1703630919

12/26/2023 19:48:39

I would like to convert the EPOCH to CST time.

Currently I am testing the following, but I am curious to know if there is an easier way.

| makeresults
| eval _time = 1703630919
| eval cst_offset = "06:00"
| convert ctime(_time) as utc_time timeformat="%H:%M"
| eval utc_time = strptime(utc_time,"%H:%M")
| eval cst_offset = strptime(cst_offset,"%H:%M")
| eval cst_time = (utc_time - cst_offset)
| convert ctime(cst_time) as cst_time timeformat="%H:%M"."CST"
| convert ctime(utc_time) as utc_time timeformat="%H:%M"."UTC"

Results in:

_time	cst_offset	cst_time	utc_time
2023-12-26 19:48:39	1703667600.000000	16:48.CST	22:48.UTC

[isoutamo]

Hi
You could set TZ on GUI. Modify user preference with selecting correct TZ.
r. Ismo

[jason_hotchkiss]

Yes, I could.  However, this is going to be a report, and for a different timezone.

[isoutamo]

Unfortunately there is no function to do this kind of action. Basically you could do your own command to do it, but probably easier way is use e.g. lookup which contains offsets and then macro which return that value based on utc time + offset calculation.