topic Re: How to change the time field value /date(1548574937484) to human readable format ? in Getting Data In

How to change the time field value /date(1548574937484) to human readable format ?

balu1211 — Thu, 03 Nov 2022 11:59:48 GMT

gcusello — Thu, 03 Nov 2022 12:09:07 GMT

<your_search> | eval date=strftime(date,"%Y-%m-%d %H:%M:%S")

Ciao.

Giuseppe

balu1211 — Thu, 03 Nov 2022 14:50:22 GMT

My usecase is like want to convert the WhenOccurred field format to readable format.

Thanks

gcusello — Thu, 03 Nov 2022 14:58:30 GMT

you need two steps:

something like this:

Ciao.

Giuseppe

balu1211 — Thu, 03 Nov 2022 17:06:41 GMT

eval WhenOccurred="/date(1548574937484)"

What i have to mention in the

| eval WhenOccurred="/date ( ) " ?

Default it is taking 1548574937484 for all values

Thanks.....

gcusello — Thu, 03 Nov 2022 18:37:29 GMT

first two rows are only for my test, your search is:

<your_search> | rex field=WhenOccurred "(?<date_epoch>\d+)" | eval date=strftime(date_epoch/1000,"%Y-%m-%d %H:%M:%S") | table date_epoch date

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉