Not getting correct time format in minutes

[aditsss]

Hi All,

I have created below query:

search index="abc"sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" | rex "TRIM\.CNX(CTR)?\.(?<TRIM_ID>\w+)"
| transaction TRIM_ID startswith="Reading Control-File /absin/TRIM.CNXCTR." endswith="Completed Settlement file processing, TRIM.CNX."
|eval StartTime=min(_time)|eval EndTime=StartTime+duration|eval duration_min=floor(duration/60) |rename duration_min as TRIM.CNX_Duration| table StartTime EndTime TRIM.CNX_Duration| sort +StartTime +EndTime]| fieldformat ProcessingStartTime = strftime(ProcessingStartTime, "%F %T.%3N")| fieldformat ProcessingEndTime = strftime(ProcessingEndTime, "%F %T.%3N")| table starttime EndTime

I am not getting the correct time I am getting in below format:

start time - 1697809010.604

EndTime - 1697809075.170

I want it in this format:

StartTime - 2023-10-20 02:16:56.629

EndTime - 2023-10-20 02:19:57.554

Can someone help me here.

[ITWhisperer · Accepted solution]

| fieldformat StartTime = strftime(StartTime, "%F %T.%3N")
| fieldformat EndTime = strftime(EndTime, "%F %T.%3N")

[aditsss]

@ITWhisperer 

How can I put it in my query can you please guide.

[aditsss]

@ITWhisperer 

I am using same in my query but not getting correct starttime and end time

query:

index="abc"sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" | rex "TRIM\.CNX(CTR)?\.(?<TRIM_ID>\w+)"
| transaction TRIM_ID startswith="Reading Control-File /absin/TRIM.CNXCTR." endswith="Completed Settlement file processing, TRIM.CNX."
|eval StartTime=min(_time)|eval EndTime=StartTime+duration|eval duration_min=floor(duration/60) |rename duration_min as TRIM.CNX_Duration| table StartTime EndTime TRIM.CNX_Duration| sort +StartTime +EndTime| fieldformat ProcessingStartTime = strftime(ProcessingStartTime, "%F %T.%3N")| fieldformat ProcessingEndTime = strftime(ProcessingEndTime, "%F %T.%3N")

[ITWhisperer]

Try changing the fieldformat lines as I suggested