Converting UTC to PST time on events?

[dionrivera]

Some of my events are displaying UTC time while others display PST time, as they should since I have my preferences set to PST. The UTC times are skewing my results. Is there a way to convert my results so that all events show UTC time or at least have a variable e.g., PST_time which shows the UTC > PST conversion?

[PickleRick]

Adding a bit to @richgalloway 's answer - by default, the only time-related thing splunk does on its own is parse the timestamp from the original event (if it knows how to do it; otherwise the event gets a timestamp other way but that's another story) and stores it as a "unix timestamp" in _time field. Whenever splunk displays the _time field, shows it in your configured timezone but the original contents of the event are shown as theynwere. And that's pretty much everything time-related that splunk does on its own.

So if your event contains a UTC timestamp and splunk extracts it properly, it will show the event as happening at a timestamp rendered in your local timezone but the raw event itself will still have the original UTC timestamp.

If you have other fields which contain time strings, unless you have some calculated fields defined which do automatic strptime/strftime (which is veeeeery unlikely), they will just be shown and possibly extracted as string values.

[richgalloway · Accepted solution]

Splunk automatically displays timestamps in your selected time zone.  If that's not happening then it's likely that Splunk is treating the field as plain text rather than a timestamp.  To fix that, use the strptime() and strftime() functions to convert the string into a timestamp string.

... | eval foo=strftime(strptime(foo, "<<format string that matches the data>>"), "<<format string that matches the data>>")

[dionrivera]

Thank you so much. I'll give this a try