Splunk Search

Convert Epoch Time to a different timezone using SPL

jason_hotchkiss
Communicator

I have the follow time:

EPOCH HUMAN READABLE

170363091912/26/2023 19:48:39


I would like to convert the EPOCH to CST time.

Currently I am testing the following, but I am curious to know if there is an easier way.

 

 

| makeresults
| eval _time = 1703630919
| eval cst_offset = "06:00"
| convert ctime(_time) as utc_time timeformat="%H:%M"
| eval utc_time = strptime(utc_time,"%H:%M")
| eval cst_offset = strptime(cst_offset,"%H:%M")
| eval cst_time = (utc_time - cst_offset)
| convert ctime(cst_time) as cst_time timeformat="%H:%M"."CST"
| convert ctime(utc_time) as utc_time timeformat="%H:%M"."UTC"

 

 

Results in:

_timecst_offsetcst_timeutc_time
2023-12-26 19:48:391703667600.00000016:48.CST22:48.UTC



Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
You could set TZ on GUI. Modify user preference with selecting correct TZ.
r. Ismo
0 Karma

jason_hotchkiss
Communicator

Yes, I could.  However, this is going to be a report, and for a different timezone.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Unfortunately there is no function to do this kind of action. Basically you could do your own command to do it, but probably easier way is use e.g. lookup which contains offsets and then macro which return that value based on utc time + offset calculation.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...