Splunk Search

How to convert epoch to local time?

subtrakt
Contributor

Hi!

I have log entries with a timestamp embedded for expiration inside the log event.

What's the best way to convert the newly generated epoch to local time?

log sample

EXPIRES Feb 11 17:11:15 2015 GMT

Search:

   ...  | rex "(?i)EXPIRES (?P.*) | eval epochtime=strptime(TEST, "%b %d %H:%M:%S %Y") | eval ET=strftime(epochtime,"%b %d %H:%M:%S %Y") 

Output sample:

TEST                       epochtime            ET
Feb 11 17:11:15 2015 GMT   1423674687.000000    Feb 11 17:11:15 2015 
0 Karma
1 Solution

ramdaspr
Contributor
| eval te=strptime(t,"%b %d %T %Y %Z") | eval tl=strftime(te,"%b %d %T %Y %Z")

You need to include the timezone capture (%Z) so that splunk can calculate what the offset needs to be.

View solution in original post

ramdaspr
Contributor
| eval te=strptime(t,"%b %d %T %Y %Z") | eval tl=strftime(te,"%b %d %T %Y %Z")

You need to include the timezone capture (%Z) so that splunk can calculate what the offset needs to be.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...