Splunk Search

How to convert epoch time to human readable format in the splunk query

Supriya
Path Finder

Could someone please help me convert epoch time to human readable time?

"Date":1605030538646

 

Labels (2)
0 Karma

to4kawa
SplunkTrust
SplunkTrust

your log is JSON. your Date field is multi-value, I guess.
eval can't go.

Tags (1)

richgalloway
SplunkTrust
SplunkTrust

Which method did you try?  Please share the full query that didn't work.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a couple of ways to convert epoch time into a human-readable format, but first you must start with epoch time in seconds rather than milliseconds.

 

... | eval humanTime = strftime(_time/1000, "%c")
... | eval timeinsecs = time/1000
| convert ctime(timeinsecs) as humanTime

 

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Supriya
Path Finder

index="index" sourcetype="Logs"|spath path="results{}.creationDate" output=CreationDate|eval time= CreationDate/1000|eval humanTime = strftime(CreatedDate/1000', "%c")|spath path="results{}.summary" output=Summary | spath path="results{}.description" output=Description | table humanTime ,Summary, Description

 

Supriya_0-1606203993863.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

My answer gave two different ways to convert epochs to human-readable times.  Use one or the other, but not both, in a query.

The command eval humanTime = strftime(CreatedDate/1000', "%c") uses a field (CreatedDate) that doesn't exist so the result will be null.

---
If this reply helps you, an upvote would be appreciated.

Supriya
Path Finder

Hi,

please find the below results:

index="index" sourcetype="Logs"|spath path="results{}.creationDate" output=CreationDate|eval time= CreationDate/1000|convert ctime(time) as humanTime |spath path="results{}.summary" output=Summary | spath path="results{}.description" output=Description | table humanTime ,Summary, Description

Supriya_1-1606203374825.png

 

 
0 Karma

richgalloway
SplunkTrust
SplunkTrust

My answer gave two different ways to convert epochs to human-readable times.  Use one or the other, but not both, in a query.

The command convert ctime(time) as humanTime uses a field (time) that doesn't exist so the result will be null.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Supriya
Path Finder

Thank you for the response,

But, It didn't help me, no output is shown.

I think (1605030538646)its a combination of Date and time

0 Karma