How to covert GMT Time(0-12:00) to PST time.

[rajhemant26]

My result is giving me the output for GMT time for the given time what I have defined.

[whrg]

Hello @rajhemant26,

If your events have an incorrect time zone, then I suggest you set the correct zone at index time using TIME_FORMAT or TZ in props.conf.

If your events have the correct time zone and you want to display them in your local time zone, then change the time zone in the user settings. (Click on your username at the top and then click on "Preferences".)

If you want to shift the time of your events at search time (I believe this is want you want), then do this:

index=dcsdjc ... | eval _time=_time-7*60*60 | ...

This will substract 7 hours from _time. It works because _time is represented as Unix epoch time.

However, it will not update the date_wday and date_hour fields.

So do this:

index=dcsdjc ... | eval _time=_time-7*60*60 | eval wday=strftime(_time,"%a") | eval hour=strftime(_time,"%H") | search hour>=0 ...

[rajhemant26]

@whrg thankyou so much for your help. but this is giving me for the entire week,
but I want to see the output only for weekdays ( Monday to Friday)

[whrg]

Add this to the search above:

| search hour>=0 hour<=12 wday IN (Mon,Tue,Wed,Thu,Fri)

Or for numerical week days ("%w" instead of "%a"):

index=dcsdjc ... | eval _time=_time-7*60*60 | eval wday=strftime(_time,"%w") | eval hour=strftime(_time,"%H") | search hour>=0 hour<=12 wday>=1 wday<=5

Check out the documentation on Date and time format variables.