topic Re: Time conversion in Splunk Search

Time conversion

Nith1 — Fri, 28 May 2021 13:13:45 GMT

Hi Team

I have the time in this format "startTime":1606406489009 i wanted to convert it to date-month-year hour-seconds can someone please help me with the query

Re: Time conversion

ITWhisperer — Fri, 28 May 2021 13:21:01 GMT

Re: Time conversion

isoutamo — Fri, 28 May 2021 22:15:26 GMT

You could found explanations for those variables here: https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables

Re: Time conversion

Nith1 — Mon, 31 May 2021 10:32:20 GMT

Hi @ITWhisperer

Thanks for the reply its working, but if we have all the logs with same kind for starttime how can we resolve that

Thanks

Re: Time conversion

ITWhisperer — Mon, 31 May 2021 14:44:48 GMT

Not sure whether there is another question here - the rex extracts the digits as a number, the number represents milliseconds since epoch, time is usually stored as seconds since epoch so divide this number by 1000, this can be done with all your events with this format for time, to display in human-readable format use fieldformat with the appropriate settings.