Splunk Search

How to convert epoch to human readable format at index time for multiple time values?

donaldwayne1975
Path Finder

Event data has multiple time values in the Epoch time format. I am able to convert the one used for event timestamp without issue. Having trouble with the eval statements in props.conf to convert the additional fields to a human-readable time for indexing.

example of times in the event (referenced as time.event, time.receive, and time.report)

example of EVAL statements

Labels (1)
Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

eval considers the dot to be a concatenation operator, use strptime('time.report', "...") - the single quotes will tell eval "this is a field name, even if it contains operators and other non-standard characters".

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

eval considers the dot to be a concatenation operator, use strptime('time.report', "...") - the single quotes will tell eval "this is a field name, even if it contains operators and other non-standard characters".

View solution in original post

donaldwayne1975
Path Finder

eureka! knew it was something small I was missing. changed it to strftime to work correctly.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Right, strftime 🙂

For posterity and future generations of googlers, this is search time, not index time.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!