Convert field from Unix Epoch Time to another format

[cosullivan66]

I have events that are being stored in large groups (say 10,000 at a time). The timestamp that they are given at index time is the time in which they are stored. The actual events themselves are from a wide range of times and a field within each event called ACTIONTIMESTAMP holds a unix epoch time formatted number. I want to convert this field to a regular, readable format like %H%M%S or something like that. Possibly create a new variable to store this converted time.

Here's an example of an event:
» 1/30/13
5:52:28.000 AM

EVENTLOGID=174045182 EVENTTYPE=MarketingEvent ..... ACTIONTIMESTAMP=1359553786.917

Thanks for any help

[Ayn]

You could use convert to create a human readable timestamp of the ACTIONTIMESTAMP value.

A better option imho would however be to setup timestamp recognition properly so that Splunk actually uses the ACTIONTIMESTAMP value instead of setting the time when the event was indexed as its timestamp. Read more about this in the docs.