linux logs only showing epoch time - how to convert epoch time upon ingestion in props/trans

[jcorcorans]

linux logs only showing epoch time - how to convert epoch time upon ingestion in props/trans ?

is there a way or a conversion to convert the epoch time to human readable upon log ingestion?

[gcusello · Accepted solution]

Hi @jcorcorans ,

during ingestion, Splunk recognize the epochtime and uses it as timestamp, so you can use _time field to have the timestamp readable.

It isn't a good practice to convert it before indexing, and anyway, you can also create an additional field at search time.

Ciao.

Giuseppe