Splunk Search

search strptime function using %Z and tz database time zones

kscher
Path Finder

Greetings,

Quoting from

https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Commontimeformatvariables,

     Refer to the list of tz database time zones for all permissible time zone values. 

My question: Given a search statement such as

 

 

strptime(SLA." ".timeZone, "%H:%M %Z")

 

 

Does Splunk have any built-in time zone database that might require periodic updates as for instance, when a locale changes its standard to daylight saving dates, or does Splunk simply use the database that's baked into a lower layer of the stack?

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It depends on your platform.  See https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Applytimezoneoffsetstotimestamps#zoneinfo_.2...

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It depends on your platform.  See https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Applytimezoneoffsetstotimestamps#zoneinfo_.2...

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

kscher
Path Finder

That wraps it up perfectly; thanks!

I’m not sure why that little nugget was so hard (for me at least) to find. “Getting Data In” was not where I expected it to show up, since we were looking at search-time strptime().

Thanks again.

 

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!