topic Re: How to convert epoch time to human readable format in the splunk query in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530479#M149876 <P>Which method did you try?&nbsp; Please share the full query that didn't work.</P> Mon, 23 Nov 2020 18:17:08 GMT richgalloway 2020-11-23T18:17:08Z How to convert epoch time to human readable format in the splunk query https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530432#M149868 <DIV class="lia-message-body lia-component-message-view-widget-body lia-component-body-signature-highlight-escalation lia-component-message-view-widget-body-signature-highlight-escalation"><DIV class="lia-message-body-content"><P>Could someone please help me convert epoch time to human readable time?</P><P>"Date":1605030538646</P><P>&nbsp;</P></DIV></DIV> Mon, 23 Nov 2020 15:37:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530432#M149868 Supriya 2020-11-23T15:37:39Z Re: How to convert epoch time to human readable format in the splunk query https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530440#M149869 <P>There are a couple of ways to convert epoch time into a human-readable format, but first you must start with epoch time in seconds rather than milliseconds.</P><P>&nbsp;</P><LI-CODE lang="markup">... | eval humanTime = strftime(_time/1000, "%c")</LI-CODE><LI-CODE lang="markup">... | eval timeinsecs = time/1000 | convert ctime(timeinsecs) as humanTime</LI-CODE><P>&nbsp;</P> Tue, 24 Nov 2020 13:31:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530440#M149869 richgalloway 2020-11-24T13:31:23Z Re: How to convert epoch time to human readable format in the splunk query https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530448#M149872 <P>Thank you for the response,</P><P>But, It didn't help me, no output is shown.</P><P>I think (1605030538646)its a combination of Date and time</P> Mon, 23 Nov 2020 15:38:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530448#M149872 Supriya 2020-11-23T15:38:59Z Re: How to convert epoch time to human readable format in the splunk query https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530479#M149876 <P>Which method did you try?&nbsp; Please share the full query that didn't work.</P> Mon, 23 Nov 2020 18:17:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530479#M149876 richgalloway 2020-11-23T18:17:08Z Re: How to convert epoch time to human readable format in the splunk query https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530532#M149884 <P>Hi,</P><P>please find the below results:</P><P>index="index" sourcetype="Logs"|spath path="results{}.creationDate" output=CreationDate|eval time= CreationDate/1000|convert ctime(time) as humanTime |spath path="results{}.summary" output=Summary | spath path="results{}.description" output=Description | table humanTime ,Summary, Description</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Supriya_1-1606203374825.png" style="width: 663px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/12030i5C3B3A870546F74D/image-dimensions/663x206?v=v2" width="663" height="206" role="button" title="Supriya_1-1606203374825.png" alt="Supriya_1-1606203374825.png" /></span></P><P>&nbsp;</P><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> Tue, 24 Nov 2020 07:42:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530532#M149884 Supriya 2020-11-24T07:42:04Z Re: How to convert epoch time to human readable format in the splunk query https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530534#M149885 <P>index="index" sourcetype="Logs"|spath path="results{}.creationDate" output=CreationDate|eval time= CreationDate/1000|eval humanTime = strftime(CreatedDate/1000', "%c")|spath path="results{}.summary" output=Summary | spath path="results{}.description" output=Description | table humanTime ,Summary, Description</P><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Supriya_0-1606203993863.png" style="width: 686px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/12031i04DD242B89AB1D51/image-dimensions/686x211?v=v2" width="686" height="211" role="button" title="Supriya_0-1606203993863.png" alt="Supriya_0-1606203993863.png" /></span></P><P>&nbsp;</P> Tue, 24 Nov 2020 07:46:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530534#M149885 Supriya 2020-11-24T07:46:44Z yourRe: How to convert epoch time to human readable format in the splunk query https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530566#M149890 <P>your log is JSON. your Date field is multi-value, I guess.<BR />eval can't go.</P> Tue, 24 Nov 2020 10:27:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530566#M149890 to4kawa 2020-11-24T10:27:37Z Re: How to convert epoch time to human readable format in the splunk query https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530594#M149897 <P>My answer gave two different ways to convert epochs to human-readable times.&nbsp; Use one or the other, but not both, in a query.</P><P>The command <FONT face="courier new,courier">convert ctime(time) as humanTime</FONT> uses a field (time) that doesn't exist so the result will be null.</P> Tue, 24 Nov 2020 13:30:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530594#M149897 richgalloway 2020-11-24T13:30:50Z Re: How to convert epoch time to human readable format in the splunk query https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530598#M149898 <P>My answer gave two different ways to convert epochs to human-readable times.&nbsp; Use one or the other, but not both, in a query.</P><P>The command <FONT face="courier new,courier"><SPAN>eval humanTime = strftime(CreatedDate/1000', "%c")</SPAN></FONT>&nbsp;uses a field (CreatedDate) that doesn't exist so the result will be null.</P> Tue, 24 Nov 2020 13:32:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-epoch-time-to-human-readable-format-in-the-splunk/m-p/530598#M149898 richgalloway 2020-11-24T13:32:34Z