topic Re: DB Connect - EPOCH TimeStamp in Getting Data In

DB Connect - EPOCH TimeStamp

j666gak — Tue, 11 Mar 2014 20:10:26 GMT

Hi,

I'm currently indexing my WHMCS logs using DB Connect. I need know how to change existing indexed time (EPOCH) and from now on the time needs indexing in a human readable format. Please can somebody help me.

id=479 date=1394496047.000 description="Cron Job: Starting Database Backup" user=System userid=0 ipaddr=

id=478 date=1394496047.000 description="DB Tables Optimized by WHMCS Cleaner" user=System userid=0 ipaddr=

id=477 date=1394496040.000 description="VCards Updated" user=System userid=0 ipaddr=

id=476 date=1394496038.000 description="Admin Email Notification Sending Failed - PHPMailer Exception - SMTP connect() failed. (Subject: WHMCS Cron Job Activity)" user=System userid=0 ipaddr=

Many thanks

Re: DB Connect - EPOCH TimeStamp

linu1988 — Tue, 11 Mar 2014 20:39:10 GMT

that wont be possible i guess, better you do a eval field in props.conf

Re: DB Connect - EPOCH TimeStamp

jcoates_splunk — Tue, 11 Mar 2014 21:02:19 GMT

Hi,

Epoch time is a good thing on the output, see the docs for more information. That said, you can use the convert command to switch to human readable in your searches and reports.