Splunk Search

Date time formatting variables not producing result I expected

pgoldweic
Communicator

Hi, I have an existing search as follows:

    | eval tempTime=strptime(due_at."-0000","%Y-%m-%d %H:%M:%S.%3N%z")
    | eval dueDateCompact = strftime(tempTime, "%m-%d-%y")

which I have used to successfully convert a string field ('due_at') representing an UTC value (although formatted without the time-zone designation at the end), to an abbreviated notation (month-day-year) displayed in local time. So, for example, if "due_at" has a value of "2023-09-30 04:59:59.000", then the resulting "dueDateCompact" field ends up with "09-29-23" in there, correctly representing  "due_at" but in Chicago local time (5 hours behind UTC). 
However, my current requirements are such that "due_at" comes formatted as "2023-09-30T04:59:59.000Z" (iso 8601 proper) instead of the original "2023-09-30 04:59:59.000" (note: only the intermediate T and ending Z are the differences between original and updated formats). 

Therefore, I updated the first part of my original search to read: 

      | eval tempTime=strptime(due_at,"%Y-%m-%d %H:%M:%S.%3QZ")
   

(so I am not appending '-0000' anymore to "due_at", since the 'Z' is present in the format string)

but this is NOT producing the correct local time in 'dueDateCompact' anymore (it produces "09-30-23" instead of "09-29-23").  

Is there a logical explanation for this? 


Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

The letter Z at the end of 2023-09-30T04:59:59.000Z signifies Zulu time. (Zulu equals UTC for practical purposes.)  All you need to do is strptime(due_at, "%Y-%m-%d %H:%M:%S.%3N%Z").

View solution in original post

pgoldweic
Communicator

Thanks @yuanliu ! That definitely does it. I was sure I had tried this already, but somehow, I seem to have missed that particular format string and was skipping the percent before the Z. Thanks again for replying!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

The letter Z at the end of 2023-09-30T04:59:59.000Z signifies Zulu time. (Zulu equals UTC for practical purposes.)  All you need to do is strptime(due_at, "%Y-%m-%d %H:%M:%S.%3N%Z").

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...