Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to Convert epoch time to human readable format...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi everyone,
I have the following event:
"... src=218.2.3.256 act=block app=ips rt=1433065461040 ...."
The rt field is a epoch computer time format.
Is it possible to convert the "rt" field to a user-friendly format? I searched through some of the other questions but none really addressed this specific question.
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use the eval function strftime
... | eval formatted_time=strftime(rt/1000, "%H:%M:%S %d-%m-%Y")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use the eval function strftime
... | eval formatted_time=strftime(rt/1000, "%H:%M:%S %d-%m-%Y")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does not work for me .
The "formatted_time" always displayed with the same value : 23:59:59 31-12-9999
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Convert your epoch time from millis to seconds
... | eval formatted_time=strftime(rt/1000, "%H:%M:%S %d-%m-%Y")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Its working!
Is it possible to do it permanent ?
I mean- To calculation it automatically on the "rt" field ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not sure what you mean but thats what splunk is for ,to transform the fields as you want when creating the reports of the dashboards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you need to do a field transform at search or index time - http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/Managefieldtransforms
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Looks good. How I can do it for all variations of the "rt" numbers?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you give more examples ?
What the End of Support for Splunk Add-on Builder Means for You
Solve, Learn, Repeat: New Puzzle Channel Now Live
Building Reliable Asset and Identity Frameworks in Splunk ES
