Splunk Search

Convert Epoch Time to a different timezone using SPL

jason_hotchkiss
Communicator

I have the follow time:

EPOCH HUMAN READABLE

170363091912/26/2023 19:48:39


I would like to convert the EPOCH to CST time.

Currently I am testing the following, but I am curious to know if there is an easier way.

 

 

| makeresults
| eval _time = 1703630919
| eval cst_offset = "06:00"
| convert ctime(_time) as utc_time timeformat="%H:%M"
| eval utc_time = strptime(utc_time,"%H:%M")
| eval cst_offset = strptime(cst_offset,"%H:%M")
| eval cst_time = (utc_time - cst_offset)
| convert ctime(cst_time) as cst_time timeformat="%H:%M"."CST"
| convert ctime(utc_time) as utc_time timeformat="%H:%M"."UTC"

 

 

Results in:

_timecst_offsetcst_timeutc_time
2023-12-26 19:48:391703667600.00000016:48.CST22:48.UTC



Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
You could set TZ on GUI. Modify user preference with selecting correct TZ.
r. Ismo
0 Karma

jason_hotchkiss
Communicator

Yes, I could.  However, this is going to be a report, and for a different timezone.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Unfortunately there is no function to do this kind of action. Basically you could do your own command to do it, but probably easier way is use e.g. lookup which contains offsets and then macro which return that value based on utc time + offset calculation.

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...