https://community.splunk.com/t5/Getting-Data-In/Date-Format/m-p/374281#M67831 <P>That's an epoch timestamp. Convert it using <CODE>strftime</CODE> as in this run-anywhere example.</P> <PRE><CODE>| makeresults | eval LastScanDate=1485064800 | eval LSD=strftime(LastScanDate,"%Y/%m/%d %H:%M:%S") | table LastScanDate LSD </CODE></PRE> Thu, 29 Jun 2017 14:32:12 GMT richgalloway 2017-06-29T14:32:12Z https://community.splunk.com/t5/Getting-Data-In/Date-Format/m-p/374280#M67830 <P>Anyone have any recommendations on how to convert this time date format to a friendly date? I have tried strftime and strptime with no luck<BR /> LastScanDate=1485064800</P> Thu, 29 Jun 2017 14:23:09 GMT https://community.splunk.com/t5/Getting-Data-In/Date-Format/m-p/374280#M67830 jhayIV 2017-06-29T14:23:09Z https://community.splunk.com/t5/Getting-Data-In/Date-Format/m-p/374281#M67831 <P>That's an epoch timestamp. Convert it using <CODE>strftime</CODE> as in this run-anywhere example.</P> <PRE><CODE>| makeresults | eval LastScanDate=1485064800 | eval LSD=strftime(LastScanDate,"%Y/%m/%d %H:%M:%S") | table LastScanDate LSD </CODE></PRE> Thu, 29 Jun 2017 14:32:12 GMT https://community.splunk.com/t5/Getting-Data-In/Date-Format/m-p/374281#M67831 richgalloway 2017-06-29T14:32:12Z