https://community.splunk.com/t5/Getting-Data-In/Convert-Epoch-using-Props-conf/m-p/250406#M48187 <P>Hi</P> <P>This sourcetype should have this configuration</P> <PRE><CODE>[mysourcetype ] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true TIME_FORMAT=%s TIME_PREFIX=event_sec= </CODE></PRE> <P>You can do more formatting at search time later on.</P> <P>Please mark as answered if this is what you were looking for.</P> <P>j</P> Thu, 28 Jan 2016 14:42:49 GMT jbjerke_splunk 2016-01-28T14:42:49Z https://community.splunk.com/t5/Getting-Data-In/Convert-Epoch-using-Props-conf/m-p/250405#M48186 <P>I have events that are coming in with no timestamp except for a field "event_sec" which gives me the time in epoch format. Is there a way to use the props.conf to convert these all to the timestamp for the events? An example of the first couple fields in the event are:</P> <P>rec_type=500 rec_type_simple="FILELOG EVENT" event_sec=1453991513</P> <P>Where as i would like to take the event_sec field and convert it to human readable date/time using the props.conf</P> Tue, 29 Sep 2020 08:34:05 GMT https://community.splunk.com/t5/Getting-Data-In/Convert-Epoch-using-Props-conf/m-p/250405#M48186 JScordo 2020-09-29T08:34:05Z https://community.splunk.com/t5/Getting-Data-In/Convert-Epoch-using-Props-conf/m-p/250406#M48187 <P>Hi</P> <P>This sourcetype should have this configuration</P> <PRE><CODE>[mysourcetype ] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true TIME_FORMAT=%s TIME_PREFIX=event_sec= </CODE></PRE> <P>You can do more formatting at search time later on.</P> <P>Please mark as answered if this is what you were looking for.</P> <P>j</P> Thu, 28 Jan 2016 14:42:49 GMT https://community.splunk.com/t5/Getting-Data-In/Convert-Epoch-using-Props-conf/m-p/250406#M48187 jbjerke_splunk 2016-01-28T14:42:49Z