How to Convert Epoch Time?

[itsmevic]

I'm running the below query to find out when was the last time an index checked in. However, in using this query the output reflects a time format that is in EPOC format. I'd like to convert it to a standard month/day/year format. Any help is appreciated. Thank you.

| tstats latest(_time) WHERE index=* BY index

[to4kawa]

see https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

month/day/year format is %x

but

| tstats latest(_time) as _time WHERE index=* BY index

This is enough.

[richgalloway · Accepted solution]

There are several ways to do that.

Start with | tstats latest(_time) as time WHERE index=* BY index then add your choice of

| eval time = strftime(time, "%c")

| convert ctime(time)

| fieldformat time = strftime(time, "%c")

[sxpati2]

This works for me: | eval time = strftime(time, "%c")

[sxpati2]

index=prd* /inf/bnkng/evnt/arrngmntorigevnt/consumr/mrtgeorig/v1/submissions/*/applications/submissionView "includeHomeInsuranceDetails=Y" ssl_client_verify= SUCCESS|table request, time|eval time = strftime(time, "%c")

Result:

GET /inf/bnkng/evnt/arrngmntorigevnt/consumr/mrtgeorig/v1/submissions/SUB501460231068589/applications/submissionView?brandSilo=ANZYU&includeHomeInsuranceDetails=Y HTTP/1.1	Sun Mar 26 08:09:28 2023
GET /inf/bnkng/evnt/arrngmntorigevnt/consumr/mrtgeorig/v1/submissions/SUB503765231068589/applications/submissionView?brandSilo=ANZYD&includeHomeInsuranceDetails=Y HTTP/1.1	Sun Mar 26 08:28:09 2023

[itsmevic]

Using the following worked:

| tstats latest(_time) as time WHERE index=* BY index
| eval time=strftime(time, "%c")

Thank you!