Splunk Search

Convert a string in ISO 8601 to local time zone (accounting for DST)

jkotula
New Member

I have a string from a complex JSON event providing an ISO 8601 date/time in UTC. I want to convert it to the local time zone, in this case CST or CDT. The computer knows its timezone and keeps its clock adjusted, so the timezone info is in there somewhere. After hours of search I can find no way that Splunk can perform this simple operation. strptime() gets me half way there, but there is no general, portable way to do the appropriate timezone adjustment.

This has nothing to do with the event timestamps! The timestamps I'm converting are different from those. All I'm looking for is simple date/time processing supported by virtually every programming language in existence...

Tags (1)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval UTC_string="Mon Jul 13 09:30:00 2017 +0000"
| eval UTC=strptime(UTC_string,"%c %z")
| eval local_time=strftime(UTC,"%+")

Hi @jkotula
There are the references.
Common time format variables

Daylight Saving Time and Time Zones in Europe
does-tz-setting-account-for-daylight-savings-time

%z is offset variables.

Changing UNIX time to a time string will basically be local time.
Wouldn't it work if I passed the offset value to strptime according to the format, as in my example?

0 Karma

jkotula
New Member

UTC format doesn't have the offset in all cases. In my case, I'm looking at JSON output generated by the Newtonsoft library in C#.

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval json_time_text="2020-01-05T13:15:30"
| eval time=strptime(json_time_text." +0000","%FT%T %z")
| eval local_time=strftime(time,"%FT%T %z")

Why don't you modify the time string when searching?

0 Karma

jkotula
New Member

Because I don't know the timezone offset. That's the whole issue.

0 Karma

jpolvino
Builder

I admit time zones are not my strong suit, but does this get you closer?

| makeresults
| eval UTCtime="2020-01-05T13:15:30Z" | fields - _time
| eval epochTime=strptime(UTCtime,"%Y-%m-%dT%H:%M:%S.%Q")
| eval mySecondsOffset=abs(tonumber(strftime(epochTime,"%:::z")))*60*60
| eval localTimestamp=strftime(epochTime-mySecondsOffset,"%Y-%m-%dT%H:%M:%S")
0 Karma

jkotula
New Member

Not really. The whole problem is that I don't know the offset, particularly with DST.

0 Karma

to4kawa
Ultra Champion

DateandTimeFunctions

what's your sample?

user preference time zone is local?

0 Karma

jkotula
New Member

What do you mean "sample"? User preference isn't the issue -- I'm using the date to look up something in a lookup table.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...