we have indexed data in UTC format and want to display in the search results stats as ET zone. Can you please provide some example.
index="myindex" earliest=-24h latest=now| stats count by date_month,date_mday,date_hour | sort count desc
In the above query giving results in UTC format results and we want to convert show as ET zone.
Assuming your local timezone is UTC (as the search results displays it). Try this
index=myindex earliest=-24h latest=now | eval EST_time=strptime(strftime(_time,"%m/%d/%Y %H:%M:%S EST"),"%m/%d/%Y %H:%M:%S %Z") | eval date_month=strftime(EST_time,"%m") | eval date_mday=strftime(EST_time,"%d") | eval date_hour=strftime(EST_time,"%H")| stats count by date_month,date_mday,date_hour | sort count desc
Assuming your local timezone is UTC (as the search results displays it). Try this
index=myindex earliest=-24h latest=now | eval EST_time=strptime(strftime(_time,"%m/%d/%Y %H:%M:%S EST"),"%m/%d/%Y %H:%M:%S %Z") | eval date_month=strftime(EST_time,"%m") | eval date_mday=strftime(EST_time,"%d") | eval date_hour=strftime(EST_time,"%H")| stats count by date_month,date_mday,date_hour | sort count desc