Convert Millseconds to Epoch Time

[IRHM73]

Hi, I wonder whether someone could help me please.

I'm extracting a time stamp in the format 2015-01-31T23:59:55.281Z which I'm trying to convert to an epoch time.

I'm using this line to do this: eval generatedAt=strptime(LoggedInTime, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y %H:%M:%S" ctime(LoggedInTime)

The problem I have is that this isn't converting the milliseconds replacing the actual milliseconds with zeroes.

Could someone possibly look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

[MuS · Accepted solution]

Hi IRHM73,

add a .%3N to the time string, see the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Commontimeformatvariables the learn more about time format options.

cheers, MuS

[IRHM73]

Hi @Mus, thank you once more for taking the time to help me.

This works perfectly.

Many thanks and kind regards

Chris