Trying to clean up some columns coming into Sentinel from syslog, and working on changing from UTC to local time.
Here is an example of what I have so far:
print dt=now()
| extend pacific_dt = datetime_utc_to_local(dt, 'US/Pacific')
| extend PacificTime = pacific_dt
| project-away dt
What I would expect is two columns, one named pacific_dt and another named PacificTime. However, when the output is displayed, both column names are appended with [UTC]. Is there a way to remove the [UTC] text that's appended or a workaround to make a new column based on that data but not get the appended text in the column name?
Here's the example code and output. Query & Output