Splunk Search

Time conversion from UST to EST in search results


Hello Team,

I am facing this issue where my logs are written in EST and the time stamp on the log is UST ( Lets say the log is written at 6PM EST and the time stamp in the log is 11PM). I am searching the logs in EST time zone. 2019-04-06 22:59:45.3711 is the timestamp format on the LOG

So the log written at 6PM EST having time stamp at 11pm isn't showing up in search until 11pm EST. I am not sure how to fix this thing. Any help is greatly appreciated.

I changed the time zone in my account to Eastern.

Tags (1)
0 Karma


This won't fix the root cause of the problem that @somesoni2 mentioned, which is that you the sourcetype is not setup with an offset as explained in the documentation, but it can make the _time appear accurately as a search time work around. This can be used to show results from the last hour

Search with UCT earliest=now latest=+4h
| eval _time=strptime(strftime(_time, "%Y-%m-%dT%H:%M:%S.%3N")."UCT", "%Y-%m-%dT%H:%M:%S.%3N%Z")
| where _time>relative_time(now(), "-1h") AND _time<now()
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma


You would need to setup timestamp parsing for your log (sourcetype) so that Splunk knows that logged timestamp is in UST (GMT/UTC).

If you could you update your logging format to include the timezone it's logging, it'll resolve the issue (without any timestamp parsing configuration, thought they are recommended). If you can't update the logging format, then you've to setup those time parsing configuration, including TZ=UTC attribute)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...