Easy Epoch time transformation

[nkrestakos]

I have a lot of DB Connect inputs connecting to MS SQL databases. a lot of the data i am pulling from these inputs have multiple date/time fields. Ususally one of the fields is my output timestamp and that will get read correctly. The other date/time fields will end up being converted by splunk to Epoch time. would i need a stanza in props.conf to address this and if so would i need to identify the fields in the stanza?

[dwaddle]

If you want the other timestamp fields left alone, you can probably achieve that in SQL. You can cast the column from a TIMESTAMP type to a VARCHAR type. I would be careful, though, of timezone issues with doing this.

Alternately, you could use calculated fields to reproduce human readable times.

[bambarit]

any tutorial for doing this one?