Splunk Search

How do I add the time zone after the time in the field?

Veeru
Path Finder

Hello,
Good Day!

I having the values in the field Data As shown below

2022-05-31 10:18:09   emea  
2022-05-31
2022-05-31 10:18:14    apac 
2022-05-31
2022-05-31 10:18:20     us 

I want to show the time zone as well like if emea comes after time it should show CST
Output should be as follows:

2022-05-31 10:18:09 CST  emea  
2022-05-31
2022-05-31 10:18:14 HKT   apac 
2022-05-31
2022-05-31 10:18:20  EDT   us 

Please help me on this
Thank you in Advance
Veeru

Labels (2)
Tags (1)
0 Karma

Veeru
Path Finder

Thanks for the help i got the results

0 Karma

venky1544
Builder

Hi @Veeru 

if it resolved your issue can you please accept the solution it might help others in the group

 

note:- If it helps karma is appreciated/if it resolves acceptance as solution is appreciated 

0 Karma

venky1544
Builder

hi @Veeru 

you can try the below query 

|makeresults |eval new = "2022-05-31 10:18:09 emea"
|append [|makeresults |eval new= "2022-05-31 10:18:14 apac"]
|append [|makeresults |eval new= "2022-05-31 10:18:20 us "]
|eval new=replace(new,"emea", "CST emea")
|eval new=replace(new,"apac", "HKT apac")
|eval new=replace(new,"us", "EDT us")

 

If it helps karma is appreciated/if it resolves acceptance as solution is appreciated 

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...