Splunk Search

How do I add the time zone after the time in the field?

Veeru
Path Finder

Hello,
Good Day!

I having the values in the field Data As shown below

2022-05-31 10:18:09   emea  
2022-05-31
2022-05-31 10:18:14    apac 
2022-05-31
2022-05-31 10:18:20     us 

I want to show the time zone as well like if emea comes after time it should show CST
Output should be as follows:

2022-05-31 10:18:09 CST  emea  
2022-05-31
2022-05-31 10:18:14 HKT   apac 
2022-05-31
2022-05-31 10:18:20  EDT   us 

Please help me on this
Thank you in Advance
Veeru

Labels (3)
Tags (1)
0 Karma

Veeru
Path Finder

Thanks for the help i got the results

0 Karma

venky1544
Builder

Hi @Veeru 

if it resolved your issue can you please accept the solution it might help others in the group

 

note:- If it helps karma is appreciated/if it resolves acceptance as solution is appreciated 

0 Karma

venky1544
Builder

hi @Veeru 

you can try the below query 

|makeresults |eval new = "2022-05-31 10:18:09 emea"
|append [|makeresults |eval new= "2022-05-31 10:18:14 apac"]
|append [|makeresults |eval new= "2022-05-31 10:18:20 us "]
|eval new=replace(new,"emea", "CST emea")
|eval new=replace(new,"apac", "HKT apac")
|eval new=replace(new,"us", "EDT us")

 

If it helps karma is appreciated/if it resolves acceptance as solution is appreciated 

Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...