Splunk Search

How do I add the time zone after the time in the field?

Veeru
Path Finder

Hello,
Good Day!

I having the values in the field Data As shown below

2022-05-31 10:18:09   emea  
2022-05-31
2022-05-31 10:18:14    apac 
2022-05-31
2022-05-31 10:18:20     us 

I want to show the time zone as well like if emea comes after time it should show CST
Output should be as follows:

2022-05-31 10:18:09 CST  emea  
2022-05-31
2022-05-31 10:18:14 HKT   apac 
2022-05-31
2022-05-31 10:18:20  EDT   us 

Please help me on this
Thank you in Advance
Veeru

Labels (3)
Tags (1)
0 Karma

Veeru
Path Finder

Thanks for the help i got the results

0 Karma

venky1544
Contributor

Hi @Veeru 

if it resolved your issue can you please accept the solution it might help others in the group

 

note:- If it helps karma is appreciated/if it resolves acceptance as solution is appreciated 

0 Karma

venky1544
Contributor

hi @Veeru 

you can try the below query 

|makeresults |eval new = "2022-05-31 10:18:09 emea"
|append [|makeresults |eval new= "2022-05-31 10:18:14 apac"]
|append [|makeresults |eval new= "2022-05-31 10:18:20 us "]
|eval new=replace(new,"emea", "CST emea")
|eval new=replace(new,"apac", "HKT apac")
|eval new=replace(new,"us", "EDT us")

 

If it helps karma is appreciated/if it resolves acceptance as solution is appreciated 

Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...