topic Re: Help with converting epoch to human readable at index time in Getting Data In

Help with converting epoch to human readable at index time

vrmandadi — Fri, 13 Mar 2020 01:49:37 GMT

I have json format data with a field called uploadDate .This has values like /Date(1584037059228)/ , /Date(1584033289090)/ etc . What stanza do I need to add at index time so that it will take the uploadDate as the timestamp field and convert it to human readable format .The following strftime works when testing

strftime(epoch/1000, "%Y-%m-%d %H:%M:%S")

Sample event

{"fileName":"TEST.yxmd","id":"0bb814","isChained":false,"metaInfo":{"author":"","copyright":"","description":"","name":"ATEST","noOutputFilesMessage":"","outputMessage":"","url":"","urlText":""},"packageType":1,"public":false,"runCount":1,"runDisabled":false,"subscriptionId":"5d395","uploadDate":"\/Date(1584037059228)\/","version":null,"workerTag":"","collections":[{"collectionId":"5e6a534","collectionName":"Test"}],"lastRunDate":"\/Date(1584037059000-0400)\/","publishedVersionId":"5e6a0031bb","publishedVersionNumber":4,"publishedVersionOwner":{"active":true,"email":"son.com","firstName":"a","id":"c398","lastName":"ngi","sId":null,"subscriptionId":"3c395"},"subscriptionName":"i"}

Thanks in Advance

Re: Help with converting epoch to human readable at index time

anmolpatel — Fri, 13 Mar 2020 01:52:22 GMT

Refer to this answer:
https://answers.splunk.com/answers/111161/how-do-i-get-splunk-to-recognise-epoch-time.html

Re: Help with converting epoch to human readable at index time

vrmandadi — Fri, 13 Mar 2020 02:19:06 GMT

@anmolpatel .Thank you for your reply but it did not work

Re: Help with converting epoch to human readable at index time

anmolpatel — Wed, 30 Sep 2020 04:37:48 GMT

check your MAX_TIMESTAMP_LOOKAHEAD (default is 128 char, which doesn't apply in your case) and TIME_PREFIX in props.conf for the selected sourcetype.

Re: Help with converting epoch to human readable at index time

nikita_p — Fri, 13 Mar 2020 11:01:32 GMT

Hey @vrmandadi,

To convert epoc time to human readable format you will have to create props.conf before indexing your data.
Please update these setting in your props.conf for respected app:

[Your_Sourcetype]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
TIME_FORMAT = %s%3N
TIME_PREFIX = \/Date
category = Structured
disabled = false
pulldown_type = true

Let me know if this works.