Getting Data In
Highlighted

Why does Splunk CSV export change the time format to Epoch time? How to fix it?

New Member

I am a newbie on Splunk. When I do a search on Splunk, time is shown as normal MM:DD:YYYY HH:MM:SS format

However, when I export the file to CSV, it automatically converts time to Epoch time.

Is there a better way to achieve this? I tried saving time to different variable in the hope it saves as string. No luck with anything. Any help is much appreciated.

Thanks in advance

Tags (4)
0 Karma
Highlighted

Re: Why does Splunk CSV export change the time format to Epoch time? How to fix it?

SplunkTrust
SplunkTrust

What version of Splunk are you running on what OS and please add the search you are using - thanks.

0 Karma
Highlighted

Re: Why does Splunk CSV export change the time format to Epoch time? How to fix it?

New Member

I am running Splunk 5.0.3 on Ubuntu 12.04. My query looks like:

eventtype="ossec" ossec_server="*" reporting_host!=ABC integrity NOT HKEY NOT tag::eventtype=noise NOT WinEvtLog NOT repo |transaction reporting_host,file_dirname|fields time, reporting_host, reporting_ip, action,file_name |mvexpand file_name
0 Karma
Highlighted

Re: Why does Splunk CSV export change the time format to Epoch time? How to fix it?

SplunkTrust
SplunkTrust

Seems like your search results include the _time field which shows human-readable format in Splunk visualizations (it's a special field) but holds an epoch value. When exported as csv, it's original epoch value can be seen.

If you want to export a string formatted date, then you'd need to create a formatted string out of _time field, like this

eventtype="ossec" ossec_server="*" reporting_host!=ABC integrity NOT HKEY NOT tag::eventtype=noise NOT WinEvtLog NOT repo |transaction reporting_host,file_dirname | eval time=strftime(_time,"%m/%d/%Y %H:%M:%S.%N") |fields time, reporting_host, reporting_ip, action,file_name |mvexpand file_name

View solution in original post

Highlighted

Re: Why does Splunk CSV export change the time format to Epoch time? How to fix it?

New Member

Thanks much @somesoni2. That works great.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.