Splunk Search

How can you adjust timezone in search? Convert UTC to AEST

ebs
Communicator

Hi, I have a field value 2021-07-26T00:30:51.411 UTC which I got from | eval strftime(_time,"%Y-%m-%dT%H:%M:%S.%Q %Z")  how can I turn this field into the Brisbane timezone (+10 hrs)?

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ebs 

User settings should have been fine could be the way _time been extracted ignored TZ settings. You can try this as an alternative.

 

| makeresults 
| eval _time="2021-07-26T00:30:51.411 UTC" 
| eval _time=strptime(_time." +1000", "%Y-%m-%dT%H:%M:%S.%3Q %Z") 
| convert ctime(_time)

 

venkatasri_0-1627341582708.png

---

An upvote would be appreciated and Accept solution if this reply helps!

 

0 Karma

ebs
Communicator

How can I apply this to a pre existing _time field value?

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@ebs Above SPL replaces _time at search-time but not permanent to indexers.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ebs 

If you are already under Brisbane timezone under user settings, and above said timestamp is mapped _time then your _time value is by default get adjusted to AEST isn't that you are after?

otherwise if time is a field not mapped to _time then a 10 hour shall be added to it.

 

0 Karma

ebs
Communicator

Hi @venkatasri 

Thanks for the answer but sadly this won't work for my use case as I'm using tstats and datamodels and even when my personal timezone is set to Brisbane the time of events is still in UTC. So it needs to be through SPL

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...