Splunk Search

Convert a string in ISO 8601 to local time zone (accounting for DST)

jkotula
New Member

I have a string from a complex JSON event providing an ISO 8601 date/time in UTC. I want to convert it to the local time zone, in this case CST or CDT. The computer knows its timezone and keeps its clock adjusted, so the timezone info is in there somewhere. After hours of search I can find no way that Splunk can perform this simple operation. strptime() gets me half way there, but there is no general, portable way to do the appropriate timezone adjustment.

This has nothing to do with the event timestamps! The timestamps I'm converting are different from those. All I'm looking for is simple date/time processing supported by virtually every programming language in existence...

Tags (1)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval UTC_string="Mon Jul 13 09:30:00 2017 +0000"
| eval UTC=strptime(UTC_string,"%c %z")
| eval local_time=strftime(UTC,"%+")

Hi @jkotula
There are the references.
Common time format variables

Daylight Saving Time and Time Zones in Europe
does-tz-setting-account-for-daylight-savings-time

%z is offset variables.

Changing UNIX time to a time string will basically be local time.
Wouldn't it work if I passed the offset value to strptime according to the format, as in my example?

0 Karma

jkotula
New Member

UTC format doesn't have the offset in all cases. In my case, I'm looking at JSON output generated by the Newtonsoft library in C#.

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval json_time_text="2020-01-05T13:15:30"
| eval time=strptime(json_time_text." +0000","%FT%T %z")
| eval local_time=strftime(time,"%FT%T %z")

Why don't you modify the time string when searching?

0 Karma

jkotula
New Member

Because I don't know the timezone offset. That's the whole issue.

0 Karma

jpolvino
Builder

I admit time zones are not my strong suit, but does this get you closer?

| makeresults
| eval UTCtime="2020-01-05T13:15:30Z" | fields - _time
| eval epochTime=strptime(UTCtime,"%Y-%m-%dT%H:%M:%S.%Q")
| eval mySecondsOffset=abs(tonumber(strftime(epochTime,"%:::z")))*60*60
| eval localTimestamp=strftime(epochTime-mySecondsOffset,"%Y-%m-%dT%H:%M:%S")
0 Karma

jkotula
New Member

Not really. The whole problem is that I don't know the offset, particularly with DST.

0 Karma

to4kawa
Ultra Champion

DateandTimeFunctions

what's your sample?

user preference time zone is local?

0 Karma

jkotula
New Member

What do you mean "sample"? User preference isn't the issue -- I'm using the date to look up something in a lookup table.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...