Getting Data In

How to change Time format in raw data to a readable format?

splunkpri
Explorer

Hi Team,

I am getting  date and time format as "Created_time =1649576166225" in raw log we have to convert. Please help me convert in readable format for all logs. Need to do any changes in input level or anything please help me

 

splunkpri_1-1649578057784.png

 

 

 

splunkpri_0-1649577907937.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkpri,

as @PickleRick said, the best approach is to leave the timestamp and all the other dates in original format so you can use them as timestamp or to compare dates.

When you need to display ine date you can use the eval command with the strftime function that disaplys a date in the format you prefer, for more infos see at https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions#Usage_3 

in few words: to dortma your date from epochtime to human readable YYYY-mm-dd HH:MM:SS you could use:

| eval Created_time=strftime(Created_time,"%Y-%m-%d %H:%M:%S")

Ciao.

Giuseppe

0 Karma

splunkpri
Explorer
 
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Do not "convert" the value. Use fieldformat to display the field in a human-readable format but leave the original field as it is. You can also create a calculated field which would give you another field containing the rendered string value.

But the first and most important thing is - since this sems to be an excerpt from some json data - where is your _time field being extracted from? Is the created_time field the only field in the event or do you have other time-related fields? If so, which of them is most important?

0 Karma

splunkpri
Explorer

Yes we do have _time field as well in RAW logs. Customer asked us they want Created_time in human readable format

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...