Trying to clean up some columns coming into Sentinel from syslog, and working on changing from UTC to local time.
Here is an example of what I have so far:
print dt=now()
| extend pacific_dt = datetime_utc_to_local(dt, 'US/Pacific')
| extend PacificTime = pacific_dt
| project-away dt
What I would expect is two columns, one named pacific_dt and another named PacificTime. However, when the output is displayed, both column names are appended with [UTC]. Is there a way to remove the [UTC] text that's appended or a workaround to make a new column based on that data but not get the appended text in the column name?
Here's the example code and output.
Please note the following:
- The current UTC value now equals to the previous PST value.
- The current PST value has double offset (-8h x 2)
Bottom line - Work with UTC, and let the client do the conversion to a local time zone.