How to get current GMT time?

[Sundried]

I have a search: 

search | eval difference=now() - strptime(createdDate,"%Y-%m-%d %H:%M:%S.%3N")

 This works, except the createdDate field from my results are in GMT+0, whilst I'm in GMT+10 so there's 10 hours added to every result. I was going to just do a -36000 bandaid fix but after daylight savings this would break.

How can I get current GMT time?

[niketn]

@Sundried try the following SPL

| eval createdDate=strptime(strftime(createdDate,"%Y-%m-%d %H:%M:%S.%3N")."+0000","%Y-%m-%d %H:%M:%S.%3N%z")

 Following is a run anywhere example:

| makeresults
| eval currentTimeInGMT=strptime(strftime(now(),"%Y-%m-%d %H:%M:%S.%3N")."+0000","%Y-%m-%d %H:%M:%S.%3N%z")
| fieldformat currentTimeInGMT=strftime(currentTimeInGMT,"%Y-%m-%d %H:%M:%S.%3N")

[Sundried]

@niketn 

This doesn't seem to get the current GMT time. At least not for me. I had to change the "+0000" to "+2000". In this case, won't it still fail after daylight savings?

[to4kawa · Accepted solution]

| makeresults
| eval time=strftime(_time,"%FT%T %:::z")
| eval offset = substr(time,21,23)
| eval time_args = if( -1 * offset >= 0, "+".substr(offset,2,3), printf("%03d",-1 * offset))
| eval GMT = ceil(relative_time(_time,time_args."h"))
| convert ctime(GMT)

now() returns epoch time(UTC). try my logic (change _time to now()).

[Sundried]

@to4kawa it works, thanks!

[harsmarvania57]

Change your user profile setting with timezone GMT.