Splunk Search

Epoch timestamp extraction not working

Flynt
Splunk Employee
Splunk Employee

I'm having difficulty extracting an Epoch timestamp in the following format - 1361463359598

I can validate that this is a true Epoch time using many programs online. In my props.conf I have %s set which is supposed to give me the correct time of Thu, 21 Feb 2013 16:15:59 GMT.

However, splunkd.log keeps telling me this timestamp is invalid -

DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Mon Jan 18 19:14:07 2038) outside of the acceptable time window.

Why is this happening and how can I tell Splunk to give me the correct timestamps?

Tags (3)
1 Solution

hexx
Splunk Employee
Splunk Employee

Your timestamp is expressed in milliseconds since the epoch, not seconds. This is why the %s TIME_FORMAT is not appropriate. Instead, use:

TIME_FORMAT = %s%3N

View solution in original post

hexx
Splunk Employee
Splunk Employee

Your timestamp is expressed in milliseconds since the epoch, not seconds. This is why the %s TIME_FORMAT is not appropriate. Instead, use:

TIME_FORMAT = %s%3N

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!