topic Re: How to convert epoch timestamp to readable date format? in Splunk Search

How to convert epoch timestamp to readable date format?

tattoostreet — Tue, 15 Jul 2014 07:54:47 GMT

Hi,

I am browsing information on one of our ticketing server databases, however, when I try to show table contents, it shows a weird format of date like the one below. Can anyone help how I can fix this? Thanks!

SystemLogID: 1713

CreatedDate: 1405343596.040

UserID: XX

Actions: XX

IsActive: XX

TicketID: XXXX

Re: How to convert epoch timestamp to readable date format?

martin_mueller — Tue, 15 Jul 2014 08:16:40 GMT

That's an epoch timestamp, seconds.milliseconds since 1970. You can convert that to a readable format by appending this to your search:

... | fieldformat CreatedDate = strftime(CreatedDate, "%F %T.%3N")

Re: How to convert epoch timestamp to readable date format?

sunnyparmar — Tue, 02 Jun 2015 07:36:44 GMT

Thanks.. It's work in my case..

Re: How to convert epoch timestamp to readable date format?

muralianup — Wed, 02 Dec 2015 11:32:28 GMT

Or you can create a macro as well.

Re: How to convert epoch timestamp to readable date format?

brigancc — Tue, 08 Dec 2015 14:13:43 GMT

My Epoch timestamp was something like this

StartTime=1449559286189
EndTime=1449577678580

So dividing it by 1000 did the trick

eval StartTime=StartTime/1000, EndTime=EndTime/1000 | fieldformat StartTime=strftime(StartTime, "%F %T.%3N") | fieldformat EndTime=strftime(EndTime, "%F %T.%3N")

Re: How to convert epoch timestamp to readable date format?

bluemarvel — Thu, 04 Aug 2016 17:56:12 GMT

works thank you