https://community.splunk.com/t5/Splunk-Search/Convert-outputted-time-epoch-to-readable-Date-time/m-p/77832#M19683 <P>Convert it to some time format you prefer using <CODE>eval</CODE> and <CODE>strftime</CODE>. "<CODE>%+</CODE>" is often a good quick format modifier for getting a readable timestamp.</P> <PRE><CODE>sourcetype="adloader" | stats min(_time) AS earliest max(_time) AS latest by TransactionID | eval duration=latest-earliest | eval earliest=strftime(earliest,"%+") | table TransactionID earliest duration </CODE></PRE> Fri, 24 Feb 2012 13:55:17 GMT Ayn 2012-02-24T13:55:17Z https://community.splunk.com/t5/Splunk-Search/Convert-outputted-time-epoch-to-readable-Date-time/m-p/77831#M19682 <P>sure this is very similar to other questions but I have not been able to apply any of the suggestions successfully.</P> <P>Search as follows:<BR /> sourcetype="adloader" | stats min(_time) AS earliest max(_time) AS latest by TransactionID | eval duration=latest-earliest | fields - latest </P> <P>output</P> <P>TransactionID - earliest - duration</P> <P>21354ewer12 - 1330088785.771 - 1.954</P> <P>how can I convert the earliest column to proper date/time format.</P> Mon, 28 Sep 2020 11:26:21 GMT https://community.splunk.com/t5/Splunk-Search/Convert-outputted-time-epoch-to-readable-Date-time/m-p/77831#M19682 gerald_huddlest 2020-09-28T11:26:21Z https://community.splunk.com/t5/Splunk-Search/Convert-outputted-time-epoch-to-readable-Date-time/m-p/77832#M19683 <P>Convert it to some time format you prefer using <CODE>eval</CODE> and <CODE>strftime</CODE>. "<CODE>%+</CODE>" is often a good quick format modifier for getting a readable timestamp.</P> <PRE><CODE>sourcetype="adloader" | stats min(_time) AS earliest max(_time) AS latest by TransactionID | eval duration=latest-earliest | eval earliest=strftime(earliest,"%+") | table TransactionID earliest duration </CODE></PRE> Fri, 24 Feb 2012 13:55:17 GMT https://community.splunk.com/t5/Splunk-Search/Convert-outputted-time-epoch-to-readable-Date-time/m-p/77832#M19683 Ayn 2012-02-24T13:55:17Z