topic Re: Why does SPLUNK show Date as a number? in Splunk Search

Why does SPLUNK show Date as a number?

hylee — Mon, 09 Dec 2013 09:37:25 GMT

Why does SPLUNK show Date as a number?

For example, data(DATETIME) in a table is "2013-12-09 18:06:12". but in SPLINK, it shows "1386579972.000".

SPLUNK doesn't read DATETIME format? or why?
I don't want to change the DB table..

Is there any way to correct in SPLUNK? help me..
I hope to see the data(DATETIME) as a date in SPLUNK..

Re: Why does SPLUNK show Date as a number?

Ayn — Mon, 09 Dec 2013 10:02:52 GMT

"1386579972" IS the date, it's just in another format - specifically, it's epoch, which is the number of seconds since January 1st 1970 00:00. You could check this yourself by using something like http://www.epochconverter.com/ .

I don't understand what the problem is. Splunk will parse this and set the correct timestamp, so what is the issue you're running into?

Re: Why does SPLUNK show Date as a number?

aholzer — Mon, 28 Sep 2020 15:27:03 GMT

Like @Ayn says, your field will be stored as an epoch time. You can then use the convert command or the strftime eval function to convert your field into a human readable format. Like so:

| convert ctime(date) as human_readable_date
or
| eval human_readable_date=strftime(date,"%Y-%m-%d %H:%M:%S")

Hope this helps

Re: Why does SPLUNK show Date as a number?

hylee — Tue, 10 Dec 2013 01:41:40 GMT

oh~ thank you so much

Re: Why does SPLUNK show Date as a number?

hylee — Tue, 10 Dec 2013 01:41:57 GMT

I didn't know that. thank you