Hello Splunk community, I need some help with the following:
I have a .csv file that is being created at a Pacific Time Zone, and the hour and date of the events I need to track are 2 separate fields in this .csv name : Date ( 09/12/2022) and "Begin Time" (06:30).
I want to table my events based on those two fields, as my time reference and not the _time (2022-12-09T10:41:02.000-05:00 )when the file was exported to Splunk which is actually a different time zone ( eastern)
What would it be the best way using those two fiels ( Date & "Begin Time") to accuratelly display the events in my .csv
thanks for your help
After reading the CSV file, you can use eval to set the _time field to a combination of the two (or more) fields.
| eval _time = strptime(Date . 'Begin Time', "%m/%d/%Y%H:%M:%SEST")