Splunk Search

Date time formatting variables not producing result I expected

pgoldweic
Communicator

Hi, I have an existing search as follows:

    | eval tempTime=strptime(due_at."-0000","%Y-%m-%d %H:%M:%S.%3N%z")
    | eval dueDateCompact = strftime(tempTime, "%m-%d-%y")

which I have used to successfully convert a string field ('due_at') representing an UTC value (although formatted without the time-zone designation at the end), to an abbreviated notation (month-day-year) displayed in local time. So, for example, if "due_at" has a value of "2023-09-30 04:59:59.000", then the resulting "dueDateCompact" field ends up with "09-29-23" in there, correctly representing  "due_at" but in Chicago local time (5 hours behind UTC). 
However, my current requirements are such that "due_at" comes formatted as "2023-09-30T04:59:59.000Z" (iso 8601 proper) instead of the original "2023-09-30 04:59:59.000" (note: only the intermediate T and ending Z are the differences between original and updated formats). 

Therefore, I updated the first part of my original search to read: 

      | eval tempTime=strptime(due_at,"%Y-%m-%d %H:%M:%S.%3QZ")
   

(so I am not appending '-0000' anymore to "due_at", since the 'Z' is present in the format string)

but this is NOT producing the correct local time in 'dueDateCompact' anymore (it produces "09-30-23" instead of "09-29-23").  

Is there a logical explanation for this? 


Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

The letter Z at the end of 2023-09-30T04:59:59.000Z signifies Zulu time. (Zulu equals UTC for practical purposes.)  All you need to do is strptime(due_at, "%Y-%m-%d %H:%M:%S.%3N%Z").

View solution in original post

pgoldweic
Communicator

Thanks @yuanliu ! That definitely does it. I was sure I had tried this already, but somehow, I seem to have missed that particular format string and was skipping the percent before the Z. Thanks again for replying!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

The letter Z at the end of 2023-09-30T04:59:59.000Z signifies Zulu time. (Zulu equals UTC for practical purposes.)  All you need to do is strptime(due_at, "%Y-%m-%d %H:%M:%S.%3N%Z").

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...