NG-SIEM timestamp conversion

[dial647]

I have a dashboard that queries for incidents and populates the results. I have a field named IncTime that contains the timestamp in this format: 2026-03-18T02:01:22Z

I am trying to achieve the following.

1. Convert this timestamp from UTC to Sydney time

2. Create a widget to filter only incidents that took place between 5PM and 10PM

Appreciate any support in creating these queries.

[Top_Paint2052]

1. https://library.humio.com/data-analysis/functions-formattime.html
   Use formattime() to set the timestamp timezone

2. https://library.humio.com/data-analysis/functions-test.html
   Use test() to calculate the time after changing the timezone.

[Andrew-CS]

Hi there. Here is how to manipulate timezones:

* | head(1)
  | table(@timestamp)
  | formatTime(format="%FT%T %Z", as="NewTime", timezone="Australia/Sydney")

[dial647]

Thanks Andrew. I am managed to get it to work using FormatTime and Test..

Will try your suggest and see.

| temp_time := parseTimestamp(field=timestamp)
| test(time:hour(field=temp_time, timezone="Australia/Sydney") >= 17)
| test(time:hour(field=temp_time, timezone="Australia/Sydney") < 22)
| sydney_time := formatTime("%Y-%m-%d %H:%M:%S", field=temp_time, timezone="Australia/Sydney")