Trying to figure out why converting time, which is stored in UTC, is not being converted correctly when going to EST. What I expect to see is -4 hours of what I have stored under my _time value and/or another field which has the same values as well. When I run the following command I get +5 hours from my UTC time. Not sure what I am doing wrong, I'm really new to Splunk so if someone could explain it that would be great.
| eval est=strptime(strftime(_time,"%Y-%m-%d %H:%M:%S EST"),"%Y-%m-%d %H:%M:%S %Z")
| eval local=strftime(est,"%Y-%m-%d %H:%M:%S")
| table _time, local
Here are my two values for _time and d_time. As you guys can see they are both stored in the same exact way. What I've been trying to do, with no success, is convert that to Eastern time.
_time = 2012-03-01T22:34:28.000+00:00
d_time = 2012-03-01T22:34:28.000+00:00
Also - forgot to mention. I am able to get the correct offset by subtracting hours in seconds from _time. But that doesn't seem like the right way to go about this.
... View more