topic Help to convert a unix time in Splunk Search

Help to convert a unix time

jip31 — Fri, 28 Jul 2023 08:26:12 GMT

I use a | stats min(_time) as time_min stats max(_time) as time_max command in my search

The time is displayed in Unix format

Example :

Time_min=1688019886.761

Time-max=1690461727.136

I have added an eval time=strftime(_time, "%d-%m-%Y %H:%M" before the stats in order to convert the time but the result is sometimes strange because the max time is older than the min time

How to convert the time properly please?

Re: Help to convert a unix time

jotne — Fri, 28 Jul 2023 08:35:56 GMT

Try this:

| stats min(_time) as time_min max(_time) as time_max | convert ctime(time_min) | convert ctime(time_max)

Re: Help to convert a unix time

jotne — Fri, 28 Jul 2023 09:06:03 GMT

You need your search above and it needs to contain the _time field. Can you post your full SPL search?

<your search> | stats min(_time) as time_min max(_time) as time_max | convert ctime(time_min) | convert ctime(time_max)

This should work with all Splunk installation:

index=_internal | stats min(_time) as time_min max(_time) as time_max | convert ctime(time_min) | convert ctime(time_max)

Re: Help to convert a unix time

jip31 — Fri, 28 Jul 2023 09:08:47 GMT

Tha.ks it works

And now if i want to format the time i need to do an eval _time?

Re: Help to convert a unix time

jotne — Fri, 28 Jul 2023 09:11:07 GMT

If you like a custom format, yes, then your need to use eval and not convert.

PS if you can accept the answer it would be fine 🙂