Splunk Search

Convert Millseconds to Epoch Time

IRHM73
Motivator

Hi, I wonder whether someone could help me please.

I'm extracting a time stamp in the format 2015-01-31T23:59:55.281Z which I'm trying to convert to an epoch time.

I'm using this line to do this: eval generatedAt=strptime(LoggedInTime, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y %H:%M:%S" ctime(LoggedInTime)

The problem I have is that this isn't converting the milliseconds replacing the actual milliseconds with zeroes.

Could someone possibly look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi IRHM73,

add a .%3N to the time string, see the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Commontimeformatvariables the learn more about time format options.

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi IRHM73,

add a .%3N to the time string, see the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Commontimeformatvariables the learn more about time format options.

cheers, MuS

0 Karma

IRHM73
Motivator

Hi @Mus, thank you once more for taking the time to help me.

This works perfectly.

Many thanks and kind regards

Chris

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...