How can i convert time values stored in epoch seconds to human readable values in splunk?

[Chris_R_]

For example I've got some values coming in such as, how can i convert the time value to a field within splunk converted to seconds?

CAA:1267224368:72853:INFO: LegID = A3974: Calling = 14082323445, called = 3666, dial peer = 1
CAA:1267224368:72854:INFO: LegID = A3974: Leg State = LEG_INCCONNECTED
CAA:1267224370:72855:INFO: Internal Document read requested, URL =

[lokispundit]

There appears to be a bug in 4.1.6 that ctime will NOT work. This seems to be resolved in 4.2.2.

[Chris_R_ · Accepted solution]

To convert the epoch seconds value you can display an additional field with the timestamp(in the format you wish. Since your data is already indexed with the timestring in epoch seconds the easiest way to convert it would be to use the IFX field picker. This will enable you to capture custom fields, Then we can run a search string to convert that value to a time format

• run a search in your ui to get results with the epoch value events and choose "extract fields"
• use the IFX field extractor shows results, highlight just the timestamp (just the seconds value )
• Test it and check your results show, when satisfied save as a custom field i'll call it "epoch_sec" for the example below

• use that custom field in a search string and pass it to the "ctime" method and use convert on the search string. Per this example

  source="/path_to_epoch_events" | convert timeformat="%m/%d/%Y %H:%M:%S" ctime(epoch_sec) as timestr 
  

[jrodman]

You can of course use other methods to get the field (rex command, manually crafted field extraction), but this gives a complete series of steps.