Date time formatting variables not producing result I expected

[pgoldweic]

Hi, I have an existing search as follows:

    | eval tempTime=strptime(due_at."-0000","%Y-%m-%d %H:%M:%S.%3N%z")
    | eval dueDateCompact = strftime(tempTime, "%m-%d-%y")

which I have used to successfully convert a string field ('due_at') representing an UTC value (although formatted without the time-zone designation at the end), to an abbreviated notation (month-day-year) displayed in local time. So, for example, if "due_at" has a value of "2023-09-30 04:59:59.000", then the resulting "dueDateCompact" field ends up with "09-29-23" in there, correctly representing  "due_at" but in Chicago local time (5 hours behind UTC). 
However, my current requirements are such that "due_at" comes formatted as "2023-09-30T04:59:59.000Z" (iso 8601 proper) instead of the original "2023-09-30 04:59:59.000" (note: only the intermediate T and ending Z are the differences between original and updated formats). 

Therefore, I updated the first part of my original search to read: 

      | eval tempTime=strptime(due_at,"%Y-%m-%d %H:%M:%S.%3QZ")
   

(so I am not appending '-0000' anymore to "due_at", since the 'Z' is present in the format string)

but this is NOT producing the correct local time in 'dueDateCompact' anymore (it produces "09-30-23" instead of "09-29-23").  

Is there a logical explanation for this? 

[pgoldweic]

Thanks @yuanliu ! That definitely does it. I was sure I had tried this already, but somehow, I seem to have missed that particular format string and was skipping the percent before the Z. Thanks again for replying!

[yuanliu · Accepted solution]

The letter Z at the end of 2023-09-30T04:59:59.000Z signifies Zulu time. (Zulu equals UTC for practical purposes.)  All you need to do is strptime(due_at, "%Y-%m-%d %H:%M:%S.%3N%Z").