Splunk Search

How to convert epoch time to human readable format in the splunk query

Supriya
Path Finder

Could someone please help me convert epoch time to human readable time?

"Date":1605030538646

 

Labels (2)
0 Karma

to4kawa
Ultra Champion

your log is JSON. your Date field is multi-value, I guess.
eval can't go.

Tags (1)

richgalloway
SplunkTrust
SplunkTrust

Which method did you try?  Please share the full query that didn't work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a couple of ways to convert epoch time into a human-readable format, but first you must start with epoch time in seconds rather than milliseconds.

 

... | eval humanTime = strftime(_time/1000, "%c")
... | eval timeinsecs = time/1000
| convert ctime(timeinsecs) as humanTime

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Supriya
Path Finder

index="index" sourcetype="Logs"|spath path="results{}.creationDate" output=CreationDate|eval time= CreationDate/1000|eval humanTime = strftime(CreatedDate/1000', "%c")|spath path="results{}.summary" output=Summary | spath path="results{}.description" output=Description | table humanTime ,Summary, Description

 

Supriya_0-1606203993863.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

My answer gave two different ways to convert epochs to human-readable times.  Use one or the other, but not both, in a query.

The command eval humanTime = strftime(CreatedDate/1000', "%c") uses a field (CreatedDate) that doesn't exist so the result will be null.

---
If this reply helps you, Karma would be appreciated.

Supriya
Path Finder

Hi,

please find the below results:

index="index" sourcetype="Logs"|spath path="results{}.creationDate" output=CreationDate|eval time= CreationDate/1000|convert ctime(time) as humanTime |spath path="results{}.summary" output=Summary | spath path="results{}.description" output=Description | table humanTime ,Summary, Description

Supriya_1-1606203374825.png

 

 
0 Karma

richgalloway
SplunkTrust
SplunkTrust

My answer gave two different ways to convert epochs to human-readable times.  Use one or the other, but not both, in a query.

The command convert ctime(time) as humanTime uses a field (time) that doesn't exist so the result will be null.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Supriya
Path Finder

Thank you for the response,

But, It didn't help me, no output is shown.

I think (1605030538646)its a combination of Date and time

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...