Splunk Search

Converting UTC to PST time on events?

dionrivera
Path Finder

Some of my events are displaying UTC time while others display PST time, as they should since I have my preferences set to PST. The UTC times are skewing my results. Is there a way to convert my results so that all events show UTC time or at least have a variable e.g., PST_time which shows the UTC > PST conversion?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk automatically displays timestamps in your selected time zone.  If that's not happening then it's likely that Splunk is treating the field as plain text rather than a timestamp.  To fix that, use the strptime() and strftime() functions to convert the string into a timestamp string.

... | eval foo=strftime(strptime(foo, "<<format string that matches the data>>"), "<<format string that matches the data>>")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Adding a bit to @richgalloway 's answer - by default, the only time-related thing splunk does on its own is parse the timestamp from the original event (if it knows how to do it; otherwise the event gets a timestamp other way but that's another story) and stores it as a "unix timestamp" in _time field. Whenever splunk displays the _time field, shows it in your configured timezone but the original contents of the event are shown as theynwere. And that's pretty much everything time-related that splunk does on its own.

So if your event contains a UTC timestamp and splunk extracts it properly, it will show the event as happening at a timestamp rendered in your local timezone but the raw event itself will still have the original UTC timestamp.

If you have other fields which contain time strings, unless you have some calculated fields defined which do automatic strptime/strftime (which is veeeeery unlikely), they will just be shown and possibly extracted as string values.

richgalloway
SplunkTrust
SplunkTrust

Splunk automatically displays timestamps in your selected time zone.  If that's not happening then it's likely that Splunk is treating the field as plain text rather than a timestamp.  To fix that, use the strptime() and strftime() functions to convert the string into a timestamp string.

... | eval foo=strftime(strptime(foo, "<<format string that matches the data>>"), "<<format string that matches the data>>")
---
If this reply helps you, Karma would be appreciated.

dionrivera
Path Finder

Thank you so much. I'll give this a try

 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...