Getting Data In

Regarding Timestamps in CSV vs PDF

LiquidTension
Path Finder

I have some users who schedule a report to come as a CSV attachment. Within that the timestamp will display differently from a PDF export of the same data. Here is an example of the first 4 timestamps of the report as a CSV vs a PDF.

CSV (_time):
1402492281
1402464600
1402474609
1402474608

PDF (_time):
2014-06-11T08:11:21.000-05:00
2014-06-11T03:16:49.000-05:00
2014-06-11T03:16:48.000-05:00
2014-06-11T00:30:00.000-05:00

I get that the timestamp in the CSV is in unix epoch. Is there a document that confirms that an export to PDF automatically converts epoch to a more human readable format?

Tags (4)
0 Karma
1 Solution

LiquidTension
Path Finder

Adding "convert ctime(_time) as timestamp" to the query allowed the csv export to display a friendlier timestamp.

View solution in original post

0 Karma

LiquidTension
Path Finder

Adding "convert ctime(_time) as timestamp" to the query allowed the csv export to display a friendlier timestamp.

0 Karma
Get Updates on the Splunk Community!

Blueprints for High-Maturity Operations: Splunk Lantern Articles on SOAR, ES 8.4, ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...