topic Re: timestamp extraction not showing milliseconds in Getting Data In

Why isn't timestamp extraction showing milliseconds?

wuming79 — Wed, 05 Apr 2023 16:34:52 GMT

Hi,

I managed to make the time format from Epoch to human readable but I can't really get the millisecond out.
Example timeStamp":1495447178314
From Splunk it converted to "5/22/17 5:59:38.000 PM" but from https://www.epochconverter.com/, it is showing
May 22, 2017 5:59:38.314 PM

Reference document: http://docs.splunk.com/Documentation/Splunk/6.0/Data/Configuretimestamprecognition, .%3N should show the milliseconds.

Re: timestamp extraction not showing milliseconds

niketn — Fri, 14 Jul 2017 13:09:51 GMT

Epoch time should be something like the following: 1495427378.314000, with decimal before millisecond. You can use %3N to display milliseconds part.

Following is the run anywhere search.

| makeresults
| eval timeStamp=strptime("05/22/17 09:59:38.314","%m/%d/%y %H:%M:%S.%3N")
| eval stringStamp=strftime(timeStamp,"%m/%d/%y %H:%M:%S.%3N")

Documentation for various time format variables: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
PS: 1st eval is to generate epoch timestamp. I have used second eval just to generate a new field to display time as string. You should ideally use fieldformat to retain time as epoch while presenting the same as string time which is human readable.

 | fieldformat  timeStamp=strftime(timeStamp,"%m/%d/%y %H:%M:%S.%3N")

Re: timestamp extraction not showing milliseconds

wuming79 — Mon, 17 Jul 2017 07:53:32 GMT

Hi harishalipaka,

using the simple syntax, I keep getting "12/31/99 23:59:59"

Re: timestamp extraction not showing milliseconds

wuming79 — Mon, 17 Jul 2017 07:54:44 GMT

Hi, does it work on 1495427378314000 without the decimal? My log timestamp was displayed without the decimal and I keep getting the time being converted as "12/31/99 23:59:59"

Re: timestamp extraction not showing milliseconds

mmcmahon — Tue, 04 Apr 2023 20:01:17 GMT

This ended up working for me:

| eval secs=substr(timestamp,0,10) | eval msecs=substr(timestamp,11,13) | strcat secs "." msecs "000" epoch_fmt | eval datetime=strftime(epoch_fmt,"%Y-%m-%d %H:%M:%S.%3N")

Re: timestamp extraction not showing milliseconds

PickleRick — Tue, 04 Apr 2023 22:16:34 GMT

| makeresults 
| eval time=_time
| eval timee=time*1000+315
| eval timeee=strptime(timee,"%s%3N")

Re: Why isn't timestamp extraction showing milliseconds?

woodcock — Wed, 12 Apr 2023 15:35:33 GMT

| makeresults
| eval timeint="1495447178314"
| eval time=strptime(timeint,"%s%3N")
| eval timestr=strftime(time, "%F %T.%3N %Z")