Getting Data In
Highlighted

Windows FileTime timestamp to human readable

Explorer

I tried a lot to convert windows filetime timestamp [web]support.microsoft.com/kb/188768) to human readable using TIME_FORMAT, but was not able to. One sample timestamp is 130308696850032106. This is supposed to be Saturday, December 7, 2013 1:01:25am.
I get this when choosing input format as 'filetime' at [web]silisoftware.com/tools/date.php

Can anyone give me any hint/pointers as to what TIME_FORMAT be set to? I tried with %s%9N but it renders as something else. I have tried convert mstime and ctime, but doesn't help.

0 Karma
Highlighted

Re: Windows FileTime timestamp to human readable

Explorer

Got the answer @answers http://answers.splunk.com/answers/63559/multiple-events-and-multiple-key-value-pairs-one-being-times...
To be exact the eval for win32 time should be eval human_time=strftime(time/10000000-11644473600,"%Y-%m-%d %H:%M:%S")

0 Karma
Highlighted

Re: Windows FileTime timestamp to human readable

Explorer

Is there anyway I could do this in props.conf while indexing and overwrite the _time value with the above calculated one?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.