https://community.splunk.com/t5/Getting-Data-In/Windows-FileTime-timestamp-to-human-readable/m-p/177834#M35652 <P>Is there anyway I could do this in props.conf while indexing and overwrite the _time value with the above calculated one?</P> Sun, 15 Dec 2013 15:48:05 GMT luckyb56 2013-12-15T15:48:05Z https://community.splunk.com/t5/Getting-Data-In/Windows-FileTime-timestamp-to-human-readable/m-p/177832#M35650 <P>I tried a lot to convert windows filetime timestamp [web]support.microsoft.com/kb/188768) to human readable using TIME_FORMAT, but was not able to. One sample timestamp is 130308696850032106. This is supposed to be Saturday, December 7, 2013 1:01:25am. <BR /> I get this when choosing input format as 'filetime' at [web]silisoftware.com/tools/date.php</P> <P>Can anyone give me any hint/pointers as to what TIME_FORMAT be set to? I tried with %s%9N but it renders as something else. I have tried convert mstime and ctime, but doesn't help. </P> Fri, 13 Dec 2013 11:30:06 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-FileTime-timestamp-to-human-readable/m-p/177832#M35650 luckyb56 2013-12-13T11:30:06Z https://community.splunk.com/t5/Getting-Data-In/Windows-FileTime-timestamp-to-human-readable/m-p/177833#M35651 <P>Got the answer @answers <A href="http://answers.splunk.com/answers/63559/multiple-events-and-multiple-key-value-pairs-one-being-timestamp-in-one-json">http://answers.splunk.com/answers/63559/multiple-events-and-multiple-key-value-pairs-one-being-timestamp-in-one-json</A> <BR /> To be exact the eval for win32 time should be eval human_time=strftime(time/10000000-11644473600,"%Y-%m-%d %H:%M:%S")</P> Sun, 15 Dec 2013 15:12:41 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-FileTime-timestamp-to-human-readable/m-p/177833#M35651 luckyb56 2013-12-15T15:12:41Z https://community.splunk.com/t5/Getting-Data-In/Windows-FileTime-timestamp-to-human-readable/m-p/177834#M35652 <P>Is there anyway I could do this in props.conf while indexing and overwrite the _time value with the above calculated one?</P> Sun, 15 Dec 2013 15:48:05 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-FileTime-timestamp-to-human-readable/m-p/177834#M35652 luckyb56 2013-12-15T15:48:05Z