Splunk Search

How to convert epoch time to a readable format?

asewell97
New Member

I'm currently creating a dashboard and need to put the time of an event into a readable format as I currently see a number such as: 1571187604872

The search I am running is:

index=BLAH Field1="BLAHBLAH" 
|eval Time=strftime(Field2, "%Y/%m/%d %H:%M")
|table Time Field3 Field4 Field5 Field6

This search doesn't gives me a readable time but the time isn't correct as the date are all the same with the year being 9999. Can somebody give me some guidance on how to correct this please?

0 Karma

woodcock
Esteemed Legend

Sometimes the field is milliseconds, not seconds; try this:

index=BLAH Field1="BLAHBLAH"
| eval Time=strftime(tonumber(Field2) / 1000, "%Y/%m/%d %H:%M")
| table Time Field3 Field4 Field5 Field6
0 Karma

adonio
Ultra Champion

looks like you epoch has milliseconds in it ... but doesnt have the dot . in place
1571187604872 should be 1571187604.872
try this website:
https://www.epochconverter.com/
then try in splunk:

 | makeresults count=1
    | eval data = "1571187604872 1571187614872 1571187605872 1571187601000"
    | makemv data
    | mvexpand data
    | eval bad_time = strftime(data, "%Y/%m/%d %H:%M")
    | eval fix_mili = tonumber(data / 1000)
    | eval good_time = strftime(fix_mili, "%Y/%m/%d %H:%M:%S")

hope it helps

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...