Time Conversion into readble format

ntalwar — Tue, 29 Sep 2020 17:18:03 GMT

Can someone help me converting 1513554224 into readable time format. I tried couple of formats but not working. I am using this search

| stats count max(_time),min(_time) by user,dest | eval time = strftime (_time, "%m/%d/%y %H:%M:%S")

Re: Time Conversion into readble format

test_qweqwe — Mon, 18 Dec 2017 00:22:49 GMT

| fieldformat time=strftime(_time, "%c")
Try this.

Re: Time Conversion into readble format

ntalwar — Mon, 18 Dec 2017 02:09:11 GMT

Nothing changed. As before. Thanks anyways

Re: Time Conversion into readble format

niketn — Mon, 18 Dec 2017 02:46:12 GMT

@ntalwar, once you use max(_time) and min(_time) within transforming command without aliasing to some other fieldname, you will have to use these in your subsequent Splunk search pipes. In your case field _time is not available after stats command.

You can try the following:

<YourBaseSearch>
| stats count max(_time),min(_time) by user,dest 
| fieldformat "latest(_time)" =strftime('latest(_time)',"%Y/%m/%d %H:%M:%S %p %z")
| fieldformat "earliest(_time)" =strftime('earliest(_time)',"%Y/%m/%d %H:%M:%S %p %z")

However, it is better to rename fields after statistical function using as to create alias. Following is what you can try

<YourBaseSearch>
| stats count latest(_time) as Last_Time, earliest(_time) as Earliest_Time by user,dest 
| fieldformat Last_Time =strftime(Last_Time,"%Y/%m/%d %H:%M:%S %p %z")
| fieldformat Earliest_Time =strftime(Earliest_Time,"%Y/%m/%d %H:%M:%S %p %z")

PS: While converting Epoch Time to String Time, I have used YYYY/MM/DD HH:MM:SS AM/PM Timezone so that they keep lexical sorting even as a String time, but you can use a different format if that is a requirement.

eval can also be used instead of fieldformat, however, the difference as listed out in Splunk Documentation/Tutorials is that fieldformat will just apply the changes for display while retaining the original type of field i.e. epoch time. The eval command on the other hand will override the underlying data type to string time as well.

Re: Time Conversion into readble format

ntalwar — Mon, 18 Dec 2017 04:27:38 GMT

Thanks a lots. It worked.

topic Re: Time Conversion into readble format in Splunk Search

Time Conversion into readble format

Re: Time Conversion into readble format

Re: Time Conversion into readble format

Re: Time Conversion into readble format

Re: Time Conversion into readble format