Splunk Search

How to covert Date and Time with timezone display?

mail2uharishp
Observer

HI All,

My name group extracts date time filed in the below format
E.g: 21/Jan/2019 09:35:25 UTC

I would like to convert it to AEST format on the fly and also it should not provide me the timezone details, rather than changing the prop file.

Tags (2)
0 Karma
1 Solution

maityayan1996
Path Finder

Hi Harish you can try this way..
| eval "UTCepoch"= strptime(Date,"%d/%b/%Y %H:%M:%S %Z") , "AESTepoch=(UTCepoch +36000) , "AESTdate"= strftime(AESTepoch,"%d/%b/%Y %H:%M:%S %Z")

In this way you will get date format in UTC to AEST.
Here 36000 is time gap between UTC and AEST in seconds.

View solution in original post

0 Karma

jaxjohnny2000
Builder

Use this

Search... | eval "Local_Time"= strftime(_time,"%d/%b/%Y %H:%M:%S %Z")

0 Karma

jaxjohnny2000
Builder

Another option

| eval "Event_Time"= strftime(_time,"%m/%d/%Y %H:%M:%S %Z")

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

0 Karma

woodcock
Esteemed Legend

Login to Splunk, go to Your Login Name Here -> Preferences -> Time zone and pick your preferred presentation TZ. Then in your searches, on the Events tab, make sure that you select Table or List view (above the i). You will now have a separate Tme (or _time) column that shows the TZ-adjusted time.

0 Karma

mail2uharishp
Observer

Hi Woodcock,

Thank you for your response, however was not preferring to change any preferences or prop file to get the desired out come, I was looking to change the time change on the fily .

0 Karma

maityayan1996
Path Finder

Hi Harish you can try this way..
| eval "UTCepoch"= strptime(Date,"%d/%b/%Y %H:%M:%S %Z") , "AESTepoch=(UTCepoch +36000) , "AESTdate"= strftime(AESTepoch,"%d/%b/%Y %H:%M:%S %Z")

In this way you will get date format in UTC to AEST.
Here 36000 is time gap between UTC and AEST in seconds.

0 Karma

mail2uharishp
Observer

Hi Maityayan,

in the above eval function we have hardcoded 36000 sec addition to UTC time, however during the daylight changes it will be made to 39600, Can i get to do that calculation dynamically?

Thanks,
Harish

0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...