Splunk Search

Convert java millisecond to date

rameshlpatel
Communicator

Hi,

I am printing current time in java milisecond in logs which i want to show in splunk by converting that into date.

STARTTIME=1420199729284

please help me to convert this into date.

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you're trying to parse that at index time, use this in props.conf:

TIME_FORMAT = %s%3N

If you're trying to format that into a readable date at search time, use this:

... | eval readable_date = strftime(STARTTIME/1000, "%F %T.%3N")
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...