topic Re: Time-Date recognize Unix Epoch Time milliseconds in Splunk Search

Time-Date recognize Unix Epoch Time milliseconds

ryastrebov — Fri, 29 Mar 2013 09:48:17 GMT

Hello!
I have log contains time-date in Unix Epoch format (milliseconds).
One event fragments is:

04,013c5f8ecc0f,013c5f8ecd04,0038af,...

Desired date is contained in column 3 (013c5f8ecd04).

During indexing process Splunk some date perceive correctly, and some not. This values (013c5f8ecd04) Splunk understand as 11/28/11 10:53:54.000 PM. It is incorrect.

Necessary to date indexing perceived correctly.
How can this be done?

Best regards,
Roman

Re: Time-Date recognize Unix Epoch Time milliseconds

eashwar — Fri, 29 Mar 2013 10:34:19 GMT

i hope it is because of the TIME ZONE configured incorrectly.

Re: Time-Date recognize Unix Epoch Time milliseconds

ryastrebov — Fri, 29 Mar 2013 10:37:41 GMT

Unlikely because in this file same part of the dates correctly perceived

Re: Time-Date recognize Unix Epoch Time milliseconds

yannK — Fri, 29 Mar 2013 14:55:16 GMT

Define a timeprefix and timeformat extraction in props.conf for this sourcetype
To verify use the data preview.

Re: Time-Date recognize Unix Epoch Time milliseconds

sideview — Mon, 28 Sep 2020 13:38:31 GMT

beware when you do get it working correctly, your date_hour fields and all your date_* fields will be calculated as though you had set the timezone explicitly to GMT, which effectively means all your date_hour values will be off by whatever your timezone offset is, and all your other date_* fields will be slightly unreliable too. This has bitten me in the past.

Re: Time-Date recognize Unix Epoch Time milliseconds

ryastrebov — Mon, 01 Apr 2013 05:34:51 GMT

Thanks for the warning! I do not know really how to correctly extract the information about the date and time from the field... Because in most cases the date is retrieved correctly.