https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-human-readable-format-at-index-time-for/m-p/498049#M141102 <P>Right, strftime <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>For posterity and future generations of googlers, this is search time, not index time.</P> Thu, 19 Mar 2020 22:21:48 GMT martin_mueller 2020-03-19T22:21:48Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-human-readable-format-at-index-time-for/m-p/498046#M141099 <P>Event data has multiple time values in the Epoch time format. I am able to convert the one used for event timestamp without issue. Having trouble with the eval statements in props.conf to convert the additional fields to a human-readable time for indexing.</P> <P>example of times in the event (referenced as time.event, time.receive, and time.report)</P> <P>example of EVAL statements</P> Thu, 18 Jun 2020 23:38:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-human-readable-format-at-index-time-for/m-p/498046#M141099 donaldwayne1975 2020-06-18T23:38:22Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-human-readable-format-at-index-time-for/m-p/498047#M141100 <P><CODE>eval</CODE> considers the dot to be a concatenation operator, use <CODE>strptime('time.report', "...")</CODE> - the single quotes will tell <CODE>eval</CODE> "this is a field name, even if it contains operators and other non-standard characters".</P> Thu, 19 Mar 2020 21:50:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-human-readable-format-at-index-time-for/m-p/498047#M141100 martin_mueller 2020-03-19T21:50:33Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-human-readable-format-at-index-time-for/m-p/498048#M141101 <P>eureka! knew it was something small I was missing. changed it to strftime to work correctly.</P> Thu, 19 Mar 2020 22:14:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-human-readable-format-at-index-time-for/m-p/498048#M141101 donaldwayne1975 2020-03-19T22:14:50Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-human-readable-format-at-index-time-for/m-p/498049#M141102 <P>Right, strftime <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>For posterity and future generations of googlers, this is search time, not index time.</P> Thu, 19 Mar 2020 22:21:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-to-human-readable-format-at-index-time-for/m-p/498049#M141102 martin_mueller 2020-03-19T22:21:48Z