DB Connect - EPOCH TimeStamp

[j666gak]

Hi,

I'm currently indexing my WHMCS logs using DB Connect. I need know how to change existing indexed time (EPOCH) and from now on the time needs indexing in a human readable format. Please can somebody help me.

id=479 date=1394496047.000 description="Cron Job: Starting Database Backup" user=System userid=0 ipaddr=

id=478 date=1394496047.000 description="DB Tables Optimized by WHMCS Cleaner" user=System userid=0 ipaddr=

id=477 date=1394496040.000 description="VCards Updated" user=System userid=0 ipaddr=

id=476 date=1394496038.000 description="Admin Email Notification Sending Failed - PHPMailer Exception - SMTP connect() failed. (Subject: WHMCS Cron Job Activity)" user=System userid=0 ipaddr=

Many thanks

[jcoates_splunk · Accepted solution]

Hi,

Epoch time is a good thing on the output, see the docs for more information. That said, you can use the convert command to switch to human readable in your searches and reports.

[linu1988]

that wont be possible i guess, better you do a eval field in props.conf