Splunk Cloud Platform

How to configure Time Format from Epoch (13 digits)?

lmmills
Engager

I am new to Splunk so please forgive me for what I do not know.  We are getting events with start=1661359208771 and need to covert it to a readable timestamp.  I have tried changing the below Timestamp format and prefix with no luck.  Any suggestions?

%s%3n.pngregex.png

Labels (2)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You had the right TIME_FORMAT the first time.  These settings should do it.

 

TIME_PREFIX = start=
TIME_FORMAT = %s%3N

If you need to experiment with ingest settings, try using the Add Data wizard.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You had the right TIME_FORMAT the first time.  These settings should do it.

 

TIME_PREFIX = start=
TIME_FORMAT = %s%3N

If you need to experiment with ingest settings, try using the Add Data wizard.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...