Reviving a dead thread but I believe your solution is precisely the same as @rocketboots_ser's, except using _time rather than a fixed time. In either case the changing of time zones doesn't affect the outcome.  A more compact rewrite is this:  | eval time_UTC = strftime(2 * _time - strptime(strftime(_time, "%F %TZ"),"%F %T%Z") Which relies on the same tricking of strptime() into thinking the output of strftime() is in UTC with the %Z variable. Doesn't matter if you use _time or 2000-01-01 as long as you're consistent.  ... View more