Splunk Search

Date time formatting variables not producing result I expected

pgoldweic
Communicator

Hi, I have an existing search as follows:

    | eval tempTime=strptime(due_at."-0000","%Y-%m-%d %H:%M:%S.%3N%z")
    | eval dueDateCompact = strftime(tempTime, "%m-%d-%y")

which I have used to successfully convert a string field ('due_at') representing an UTC value (although formatted without the time-zone designation at the end), to an abbreviated notation (month-day-year) displayed in local time. So, for example, if "due_at" has a value of "2023-09-30 04:59:59.000", then the resulting "dueDateCompact" field ends up with "09-29-23" in there, correctly representing  "due_at" but in Chicago local time (5 hours behind UTC). 
However, my current requirements are such that "due_at" comes formatted as "2023-09-30T04:59:59.000Z" (iso 8601 proper) instead of the original "2023-09-30 04:59:59.000" (note: only the intermediate T and ending Z are the differences between original and updated formats). 

Therefore, I updated the first part of my original search to read: 

      | eval tempTime=strptime(due_at,"%Y-%m-%d %H:%M:%S.%3QZ")
   

(so I am not appending '-0000' anymore to "due_at", since the 'Z' is present in the format string)

but this is NOT producing the correct local time in 'dueDateCompact' anymore (it produces "09-30-23" instead of "09-29-23").  

Is there a logical explanation for this? 


Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

The letter Z at the end of 2023-09-30T04:59:59.000Z signifies Zulu time. (Zulu equals UTC for practical purposes.)  All you need to do is strptime(due_at, "%Y-%m-%d %H:%M:%S.%3N%Z").

View solution in original post

pgoldweic
Communicator

Thanks @yuanliu ! That definitely does it. I was sure I had tried this already, but somehow, I seem to have missed that particular format string and was skipping the percent before the Z. Thanks again for replying!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

The letter Z at the end of 2023-09-30T04:59:59.000Z signifies Zulu time. (Zulu equals UTC for practical purposes.)  All you need to do is strptime(due_at, "%Y-%m-%d %H:%M:%S.%3N%Z").

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...