Why does Splunk CSV export change the time format to Epoch time? How to fix it?

[rajnepali]

I am a newbie on Splunk. When I do a search on Splunk, time is shown as normal MM:DD:YYYY HH:MM:SS format

However, when I export the file to CSV, it automatically converts time to Epoch time.

Is there a better way to achieve this? I tried saving time to different variable in the hope it saves as string. No luck with anything. Any help is much appreciated.

Thanks in advance

[somesoni2 · Accepted solution]

Seems like your search results include the _time field which shows human-readable format in Splunk visualizations (it's a special field) but holds an epoch value. When exported as csv, it's original epoch value can be seen.

If you want to export a string formatted date, then you'd need to create a formatted string out of _time field, like this

eventtype="ossec" ossec_server="*" reporting_host!=ABC integrity NOT HKEY NOT tag::eventtype=noise NOT WinEvtLog NOT repo |transaction reporting_host,file_dirname | eval time=strftime(_time,"%m/%d/%Y %H:%M:%S.%N") |fields time, reporting_host, reporting_ip, action,file_name |mvexpand file_name

[rajnepali]

Thanks much @somesoni2. That works great.

[MuS]

What version of Splunk are you running on what OS and please add the search you are using - thanks.

[rajnepali]

I am running Splunk 5.0.3 on Ubuntu 12.04. My query looks like:

eventtype="ossec" ossec_server="*" reporting_host!=ABC integrity NOT HKEY NOT tag::eventtype=noise NOT WinEvtLog NOT repo |transaction reporting_host,file_dirname|fields time, reporting_host, reporting_ip, action,file_name |mvexpand file_name