Getting Data In

Mapping date from big file with date format in epoch milliseconds.

brent_weaver
Builder

I have a nice CEF file that parses quite nicely except the date is burred deep in the file and is in epoch milliseconds. The field name is start, how do I make that my datetime stamp when this indexes.

Thanks!

Tags (1)
0 Karma
1 Solution

inventsekar
Ultra Champion

if your data timestamp, for example -

TIME:1459495744806

To extract that timestamp, add this stanza in props.conf:

[host::foo]
TIME_PREFIX = TIME:
TIME_FORMAT=%s%3N

%s -- for Epoch (10 digits) and %3N for milli-seconds

http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Configuretimestamprecognition

if you are having "1459495744806" inside an event and query and convert it to required timestamp -

| makeresults | fields - _time | eval timeTest = "1474993609302"
 | eval timeStamp=strptime(timeTest,"%s%3N") 
 | eval timeStamp=strftime(timeStamp,"%m/%d/%Y:%H:%M:%S") 
| table timeStamp

alt text

View solution in original post

0 Karma

inventsekar
Ultra Champion

if your data timestamp, for example -

TIME:1459495744806

To extract that timestamp, add this stanza in props.conf:

[host::foo]
TIME_PREFIX = TIME:
TIME_FORMAT=%s%3N

%s -- for Epoch (10 digits) and %3N for milli-seconds

http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Configuretimestamprecognition

if you are having "1459495744806" inside an event and query and convert it to required timestamp -

| makeresults | fields - _time | eval timeTest = "1474993609302"
 | eval timeStamp=strptime(timeTest,"%s%3N") 
 | eval timeStamp=strftime(timeStamp,"%m/%d/%Y:%H:%M:%S") 
| table timeStamp

alt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...