Splunk Search

Convert field from Unix Epoch Time to another format

cosullivan66
Explorer

I have events that are being stored in large groups (say 10,000 at a time). The timestamp that they are given at index time is the time in which they are stored. The actual events themselves are from a wide range of times and a field within each event called ACTIONTIMESTAMP holds a unix epoch time formatted number. I want to convert this field to a regular, readable format like %H%M%S or something like that. Possibly create a new variable to store this converted time.

Here's an example of an event:
» 1/30/13
5:52:28.000 AM

EVENTLOGID=174045182 EVENTTYPE=MarketingEvent ..... ACTIONTIMESTAMP=1359553786.917

Thanks for any help

Tags (2)
0 Karma

Ayn
Legend

You could use convert to create a human readable timestamp of the ACTIONTIMESTAMP value.

A better option imho would however be to setup timestamp recognition properly so that Splunk actually uses the ACTIONTIMESTAMP value instead of setting the time when the event was indexed as its timestamp. Read more about this in the docs.

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...