When retrieving results from Splunk, I get a _time field with the following value:
2016-08-26 12:50:03.000 GMT Daylight Time
As I'm in the UK and experiencing Daylight savings time, I know that should be a timezone of +01:00, however, I can't find any way to parse the timezone properly.
Splunk claims to use the the TZ Database, however, the string GMT Daylight Time doesn't appear in the linked Wikipedia article.
Can I convince Splunk to use ISO 8601 formatting? Failing that, are the TZ strings splunk uses a standard format that I'm unaware of?
As it stands, it looks like I'm going to have to build and maintain a list of timezones just to parse messages correctly, which seems like a lot of unnecessary effort.
In case it helps, I'm currently using the Arrow library to handle dates, but can use another if required.
As requested in comments:
I'm POSTing the following data:
# self.filename is the path to the file I'm interested in. eg C:\Example.txt
# EventCode 4656 represents an access audit (raised when a file handle is requested)
{'search': 'search index=* EventCode=4656 Object_Name="{0}"| eval tztime = strftime(_time,"%Z") | sort -date'.format(
self.filename.replace('\\', '\\\\')),
'output_mode': 'json'}
To this url:
https://{server}:{port}/servicesNS/admin/search/search/jobs/export
Related
i`m trying to translate this list of utc offsets:
['UTC-12:00','UTC-11:00','UTC-10:00','UTC-09:00','UTC-08:00','UTC-07:00','UTC-06:00','UTC-05:00','UTC-04:00','UTC+10:00','UTC+12:00']
into a list of named time zones using pytz library
e.g. Pacific/Honolulu
after an hour of fighting with chatgpt i was always getting an error message and conflicting results from chatgpt.
after talking with my teacher she offered this solution:
tz = pytz.FixedOffset(180)
now = timezone.now()
local_now = tz.normalize(now.astimezone(tz))
after which i was getting an error regarding timezone having no attribute now
not sure if related or not but the list of timezones are recieved through dict indexing (think that is the correct term) from a json file recieved from the nationalize.io free rest api
country_timezones = list(restcountries_country_info.json()[0]['timezones'])
countries_details[country_code]['timezones'] = country_timezones
I have an input which may contain a date, or time, or both. In case the date is provided I can use that date but in case the date is not provided (i.e. only the time is provided) then I have to use a different date provided from someplace else.
But once I parse the date using using python dateutil, today's date is added to the parsed value. For example:
from dateutil.parser import parse
print(parse('03:15:08'))
print(parse('04-04-2019 03:15:08'))
the above code gives the following output:
2019-04-04 03:15:08
2019-04-04 03:15:08
As you can see the information (that the date was provided or not) is lost and can't be differentiated.
Also some kind of length manipulation may not work because only the date may be provided.
How to differentiate between the 2 inputs?
Thank you.
I want to capture a timestamp and the current timezone and serialize it into a file (in JSON or YAML, but that's not really my question) for later retrieval on a different computer.
The timestamp is easy, I'll just use time.time().
For getting the current timezone, I read another SO question and it seems appropriate to use dateutil.tz.tzlocal
to get the current timezone.
Now I just need to figure out how to serialize it. The name is easy, that's just a string, but the offset seems to be weird; I was expecting just a number:
import time
import datetime
import dateutil
now = datetime.datetime.utcfromtimestamp(time.time())
tzlocal = dateutil.tz.tzlocal()
print tzlocal.tzname(now)
print tzlocal.utcoffset(now)
but this prints
US Mountain Standard Time
-1 day, 17:00:00
and the result of utcoffset appears to be an object. How do I just get the number?
Oh, never mind, tzlocal.utcoffset(now) returns a datetime.timedelta and I can just call total_seconds():
import time
import datetime
import dateutil
import json
now = datetime.datetime.utcfromtimestamp(time.time())
tzlocal = dateutil.tz.tzlocal()
info_str = json.dumps(dict(name=tzlocal.tzname(now),
offset=tzlocal.utcoffset(now).total_seconds()))
print info_str
which prints (on my PC)
{"name": "US Mountain Standard Time", "offset": -25200.0}
I'm not sure what your application is but as a default I recommend serializing to ISO 8601 timestamps with a time zone offset. Even better, convert to UTC first... this makes things easier for humans who happen to browse the serialized data, because they don't have to do the date math in their head.
There may be performance reasons for sticking with numeric timestamps, but I'd want proof this was a bottleneck in my application before giving up the human-readable bonus of ISO timestamps.
I'm looking to build a Python application which will receive timezone information from an Android phone, which I'd like to convert to a datetime tzinfo object (for example, as implemented by pytz).
This little Java program shows a 'sample' of the formats for TimeZone available:
import java.util.TimeZone;
public class GetLocalTimeZone {
public static void main(String []args) {
TimeZone local_tz = TimeZone.getDefault();
System.out.println(local_tz.getDisplayName());
System.out.println(local_tz.getID());
System.out.println(local_tz.getRawOffset());
}
}
which prints
Central European Time
Europe/Amsterdam
3600000
In accordance with the TimeZone documentation, the getRawOffset() function returns "the amount of time in milliseconds to add to UTC to get standard time in this time zone". This seems like a good starting point to instantiate a datetime.tzinfo object.
The problem is that although I can instantiate one using the output of the getID() method, e.g.
import pytz
amsterdam = pytz.timezone('Europe/Amsterdam')
I'm not sure how to instantiate a timezone with the numerical offset, even if I convert it to hours. For example,
pytz.timezone('+01:00')
yields a UnknownTimeZoneError. How would I go about creating a datetime.tzinfo object from the offset from UTC (in milliseconds)? (I'm also open to other implementations such as Arrow and Pendulum).
Your problem is that a timezone includes both an offset, and daylight savings information.
There can be timezones with the same offset but which do daylight savings differently, so the offset alone is not sufficient to identify the timezone.
If possible, you should use the Display Name and/or ID.
If you can't do that, your best bet is to enumerate all timezones, and get a shortlist based on which ones have that offset for at least part of the year. Then you will have to pick one somehow.
In my Django application I get times from a webservice, provided as a string, that I use in my templates:
{{date.string}}
This provides me with a date such as:
2009-06-11 17:02:09+0000
These are obviously a bit ugly, and I'd like to present them in a nice format to my users. Django has a great built in date formatter, which would do exactly what I wanted:
{{ value|date:"D d M Y" }}
However this expects the value to be provided as a date object, and not a string. So I can't format it using this. After searching here on StackOverflow pythons strptime seems to do what I want, but being fairly new to Python I was wondering if anyone could come up with an easier way of getting date formatting using strings, without having to resort to writing a whole new custom strptime template tag?
You're probably better off parsing the string received from the webservice in your view code, and then passing the datetime.date (or string) to the template for display. The spirit of Django templates is that very little coding work should be done there; they are for presentation only, and that's why they go out of their way to prevent you from writing Python code embedded in HTML.
Something like:
from datetime import datetime
from django.shortcuts import render_to_response
def my_view(request):
ws_date_as_string = ... get the webservice date
the_date = datetime.strptime(ws_date, "%Y-%m-%d %H:%M:%S+0000")
return render_to_response('my_template.html', {'date':the_date})
As Matthew points out, this drops the timezone. If you wish to preserve the offset from GMT, try using the excellent third-party dateutils library, which seamlessly handles parsing dates in multiple formats, with timezones, without having to provide a time format template like strptime.
This doesn't deal with the Django tag, but the strptime code is:
d = strptime("2009-06-11 17:02:09+0000", "%Y-%m-%d %H:%M:%S+0000")
Note that you're dropping the time zone info.