How to change the time field value /date(1548574937484) to human readable format ?

[gcusello]

Hi @balu1211,

you have to use the strftime option in the eval command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/DateandTimeFunctions#strftime.28...), something like this:

<your_search>
| eval date=strftime(date,"%Y-%m-%d %H:%M:%S")

Ciao.

Giuseppe

[balu1211]

Hi @gcusello ,

My usecase is like want to convert the WhenOccurred field format to readable format.

Thanks 

 

[gcusello · Accepted solution]

Hi @balu1211,

you need two steps:

• extract the date in epochtime format
• convert date from epochtime to Human Readable.

something like this:

| makeresults 
| eval WhenOccurred="/date(1548574937484)"
| rex field=WhenOccurred "(?<date_epoch>\d+)"
| eval date=strftime(date_epoch/1000,"%Y-%m-%d %H:%M:%S")
| table date_epoch date

Ciao.

Giuseppe

[balu1211]

Hi @gcusello,

eval WhenOccurred="/date(1548574937484)"

What i have to mention in the  

| eval  WhenOccurred="/date (   ) "   ? 

Default it is taking 1548574937484 for all  values 

Thanks.....

[gcusello]

Hi @balu1211,

first two rows are only for my test, your search is:

<your_search>
| rex field=WhenOccurred "(?<date_epoch>\d+)"
| eval date=strftime(date_epoch/1000,"%Y-%m-%d %H:%M:%S")
| table date_epoch date

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉