Convert Epoch time to human date at index time?

mansamusa27 — Thu, 22 Sep 2022 15:51:18 GMT

Hi,

I want to convert Epoch time appearing in my events in a field but I want to convert it at index time so that when I search for events instead of

{"@timestamp":1663854197000,"event":{"id":"101........................

I want to change it to

{"@timestamp":human readable format,"event":{"id":"101........................

I know that splunk reads the epoch time and converts it to human readable format under the _time field but I want to transform the raw events to have human readable format.

I am assuming I would need to do it on props.conf to do it at index time, maybe SEDCMD could do it I am not sure I just cant get down the right syntax for this I would really appreciate if anyone can help with this.

Thank you in advance!

topic Convert Epoch time to human date at index time? in Getting Data In

Convert Epoch time to human date at index time?