Splunk Search

How do I add the time zone after the time in the field?

Veeru
Path Finder

Hello,
Good Day!

I having the values in the field Data As shown below

2022-05-31 10:18:09   emea  
2022-05-31
2022-05-31 10:18:14    apac 
2022-05-31
2022-05-31 10:18:20     us 

I want to show the time zone as well like if emea comes after time it should show CST
Output should be as follows:

2022-05-31 10:18:09 CST  emea  
2022-05-31
2022-05-31 10:18:14 HKT   apac 
2022-05-31
2022-05-31 10:18:20  EDT   us 

Please help me on this
Thank you in Advance
Veeru

Labels (3)
Tags (1)
0 Karma

Veeru
Path Finder

Thanks for the help i got the results

0 Karma

venky1544
Contributor

Hi @Veeru 

if it resolved your issue can you please accept the solution it might help others in the group

 

note:- If it helps karma is appreciated/if it resolves acceptance as solution is appreciated 

0 Karma

venky1544
Contributor

hi @Veeru 

you can try the below query 

|makeresults |eval new = "2022-05-31 10:18:09 emea"
|append [|makeresults |eval new= "2022-05-31 10:18:14 apac"]
|append [|makeresults |eval new= "2022-05-31 10:18:20 us "]
|eval new=replace(new,"emea", "CST emea")
|eval new=replace(new,"apac", "HKT apac")
|eval new=replace(new,"us", "EDT us")

 

If it helps karma is appreciated/if it resolves acceptance as solution is appreciated 

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...