How to convert epoch time to human readable format in the splunk query

[Supriya]

Could someone please help me convert epoch time to human readable time?

"Date":1605030538646

[Supriya]

Could someone please help me convert epoch time to human readable time?

"Date":1605030538646

[to4kawa]

your log is JSON. your Date field is multi-value, I guess.
eval can't go.

[richgalloway]

Which method did you try?  Please share the full query that didn't work.

[richgalloway]

There are a couple of ways to convert epoch time into a human-readable format, but first you must start with epoch time in seconds rather than milliseconds.

... | eval humanTime = strftime(_time/1000, "%c")

... | eval timeinsecs = time/1000
| convert ctime(timeinsecs) as humanTime

[Supriya]

index="index" sourcetype="Logs"|spath path="results{}.creationDate" output=CreationDate|eval time= CreationDate/1000|eval humanTime = strftime(CreatedDate/1000', "%c")|spath path="results{}.summary" output=Summary | spath path="results{}.description" output=Description | table humanTime ,Summary, Description

[richgalloway]

My answer gave two different ways to convert epochs to human-readable times.  Use one or the other, but not both, in a query.

The command eval humanTime = strftime(CreatedDate/1000', "%c") uses a field (CreatedDate) that doesn't exist so the result will be null.

[Supriya]

Hi,

please find the below results:

index="index" sourcetype="Logs"|spath path="results{}.creationDate" output=CreationDate|eval time= CreationDate/1000|convert ctime(time) as humanTime |spath path="results{}.summary" output=Summary | spath path="results{}.description" output=Description | table humanTime ,Summary, Description

[richgalloway]

My answer gave two different ways to convert epochs to human-readable times.  Use one or the other, but not both, in a query.

The command convert ctime(time) as humanTime uses a field (time) that doesn't exist so the result will be null.

[Supriya]

Thank you for the response,

But, It didn't help me, no output is shown.

I think (1605030538646)its a combination of Date and time