topic Re: Why does Splunk CSV export change the time format to Epoch time? How to fix it? in Getting Data In

Why does Splunk CSV export change the time format to Epoch time? How to fix it?

rajnepali — Thu, 11 Aug 2016 20:38:54 GMT

I am a newbie on Splunk. When I do a search on Splunk, time is shown as normal MM:DD:YYYY HH:MM:SS format

However, when I export the file to CSV, it automatically converts time to Epoch time.

Is there a better way to achieve this? I tried saving time to different variable in the hope it saves as string. No luck with anything. Any help is much appreciated.

Thanks in advance

Re: Why does Splunk CSV export change the time format to Epoch time? How to fix it?

MuS — Thu, 11 Aug 2016 20:47:17 GMT

What version of Splunk are you running on what OS and please add the search you are using - thanks.

Re: Why does Splunk CSV export change the time format to Epoch time? How to fix it?

rajnepali — Thu, 11 Aug 2016 20:52:38 GMT

I am running Splunk 5.0.3 on Ubuntu 12.04. My query looks like:

eventtype="ossec" ossec_server="*" reporting_host!=ABC integrity NOT HKEY NOT tag::eventtype=noise NOT WinEvtLog NOT repo |transaction reporting_host,file_dirname|fields time, reporting_host, reporting_ip, action,file_name |mvexpand file_name

Re: Why does Splunk CSV export change the time format to Epoch time? How to fix it?

somesoni2 — Thu, 11 Aug 2016 21:26:18 GMT

Seems like your search results include the _time field which shows human-readable format in Splunk visualizations (it's a special field) but holds an epoch value. When exported as csv, it's original epoch value can be seen.

If you want to export a string formatted date, then you'd need to create a formatted string out of _time field, like this

eventtype="ossec" ossec_server="*" reporting_host!=ABC integrity NOT HKEY NOT tag::eventtype=noise NOT WinEvtLog NOT repo |transaction reporting_host,file_dirname | eval time=strftime(_time,"%m/%d/%Y %H:%M:%S.%N") |fields time, reporting_host, reporting_ip, action,file_name |mvexpand file_name

Re: Why does Splunk CSV export change the time format to Epoch time? How to fix it?

rajnepali — Thu, 11 Aug 2016 21:47:53 GMT

Thanks much @somesoni2. That works great.