Splunk Search

How to convert epoch time to human readable format in search query?

ziyod2005
Explorer

Could someone please help me convert epoch time to human readable time?

"time":1407361408100

this is what i'm trying to get "time":"Wed, 06 Aug 2014 21:43:28"

Tags (3)
1 Solution

strive
Influencer

Try this

sourcetype=test | eval c_time=strftime(log_time,"%m/%d/%y %H:%M:%S") | table _time, c_time

the function strftime(X,Y) takes an epochtime value, X, as the first argument and renders it as a string using the format specified by Y.

View solution in original post

Supriya
Path Finder

Hi,

I'm looking for the answer for the question you posted,

Do you find any answer for this?

0 Karma

ziyod2005
Explorer

I'm trying to convert 1407361408100 to some human readable format.

I've tried to used convert function but not getting the correct result
sourcetype=test | convert timeformat=" %m/%d/%y %H:%M:%S" ctime(log_time) AS c_time | table _time, c_time

0 Karma

somesoni2
Revered Legend

Where are you trying to convert this?

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...