How to convert epoch time with milliseconds into splunk at indexing time

[vrmandadi]

I have a file that I am monitoring has time in epoch format milliseconds .What setting should be placed in the props.conf to convert it to human readable

[manjunathmeti]

Use INGEST_EVAL in transforms.conf on indexers:

props.conf

[mysourcetype]
TRANSFORMS = myeval

transforms.conf

[myeval]
INGEST_EVAL = human_readable_field = strftime(epoch_field_from_data, "%m-%d-%Y %H:%M:%S.%3N")

And on search heads add this field in fields.conf so that users can search this field.
fields.conf

[human_readable_field]
INDEXED = True

[richgalloway · Accepted solution]

You don't want to convert timestamps to human-readable format at index time because a human is not reading the timestamp at index time. Use TIME_FORMAT = %s%3N to tell Splunk the timestamp is in epoch form with milliseconds. Remember to set TIME_PREFIX properly.

Do the conversion to human-readable format at search time. Do so using fieldformat as late as possible in the query.

[vrmandadi]

Thank you @richgalloway .What time format do I need to set for events which have Mar 25, 21:43 UTC as timestamp

[richgalloway]

%b %d, %H:%M:%S %Z. See the "Date and time format variables" section of the Search Reference manual.

[vrmandadi]

Thank You.