Splunk Search

search strptime function using %Z and tz database time zones

kscher
Path Finder

Greetings,

Quoting from

https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Commontimeformatvariables,

     Refer to the list of tz database time zones for all permissible time zone values. 

My question: Given a search statement such as

 

 

strptime(SLA." ".timeZone, "%H:%M %Z")

 

 

Does Splunk have any built-in time zone database that might require periodic updates as for instance, when a locale changes its standard to daylight saving dates, or does Splunk simply use the database that's baked into a lower layer of the stack?

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It depends on your platform.  See https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Applytimezoneoffsetstotimestamps#zoneinfo_.2...

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It depends on your platform.  See https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Applytimezoneoffsetstotimestamps#zoneinfo_.2...

---
If this reply helps you, Karma would be appreciated.

kscher
Path Finder

That wraps it up perfectly; thanks!

I’m not sure why that little nugget was so hard (for me at least) to find. “Getting Data In” was not where I expected it to show up, since we were looking at search-time strptime().

Thanks again.

 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...