Splunk Search

Convert java millisecond to date

rameshlpatel
Communicator

Hi,

I am printing current time in java milisecond in logs which i want to show in splunk by converting that into date.

STARTTIME=1420199729284

please help me to convert this into date.

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you're trying to parse that at index time, use this in props.conf:

TIME_FORMAT = %s%3N

If you're trying to format that into a readable date at search time, use this:

... | eval readable_date = strftime(STARTTIME/1000, "%F %T.%3N")
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...