Splunk Search
Highlighted

How to convert epoch to human readable format at index time for multiple time values?

Path Finder

Event data has multiple time values in the Epoch time format. I am able to convert the one used for event timestamp without issue. Having trouble with the eval statements in props.conf to convert the additional fields to a human-readable time for indexing.

example of times in the event (referenced as time.event, time.receive, and time.report)

example of EVAL statements

Labels (1)
Tags (1)
0 Karma
Highlighted

Re: How to convert epoch to human readable format at index time for multiple time values?

SplunkTrust
SplunkTrust

eval considers the dot to be a concatenation operator, use strptime('time.report', "...") - the single quotes will tell eval "this is a field name, even if it contains operators and other non-standard characters".

View solution in original post

Highlighted

Re: How to convert epoch to human readable format at index time for multiple time values?

Path Finder

eureka! knew it was something small I was missing. changed it to strftime to work correctly.

0 Karma
Highlighted

Re: How to convert epoch to human readable format at index time for multiple time values?

SplunkTrust
SplunkTrust

Right, strftime 🙂

For posterity and future generations of googlers, this is search time, not index time.

0 Karma