Splunk Search

Easy Epoch time transformation


I have a lot of DB Connect inputs connecting to MS SQL databases. a lot of the data i am pulling from these inputs have multiple date/time fields. Ususally one of the fields is my output timestamp and that will get read correctly. The other date/time fields will end up being converted by splunk to Epoch time. would i need a stanza in props.conf to address this and if so would i need to identify the fields in the stanza?

Tags (3)
0 Karma


If you want the other timestamp fields left alone, you can probably achieve that in SQL. You can cast the column from a TIMESTAMP type to a VARCHAR type. I would be careful, though, of timezone issues with doing this.

Alternately, you could use calculated fields to reproduce human readable times.

0 Karma


any tutorial for doing this one?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...