Splunk Search

Time conversion

Nith1
Path Finder

Hi Team

 

I have the time in this format "startTime":1606406489009 i wanted to convert it to date-month-year hour-seconds can someone please help me with the query

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Not sure whether there is another question here - the rex extracts the digits as a number, the number represents milliseconds since epoch, time is usually stored as seconds since epoch so divide this number by 1000, this can be done with all your events with this format for time, to display in human-readable format use fieldformat with the appropriate settings.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="\"startTime\":1606406489009"
| rex "startTime\":(?<time>\d+)"
| eval seconds=time/1000
| fieldformat seconds=strftime(seconds,"%Y-%m-%d %H:%M:%S.%Q")
0 Karma

Nith1
Path Finder

Hi @ITWhisperer 

Thanks for the reply its working, but if we have all the logs with same kind for starttime how can we resolve that

 

Thanks

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not sure whether there is another question here - the rex extracts the digits as a number, the number represents milliseconds since epoch, time is usually stored as seconds since epoch so divide this number by 1000, this can be done with all your events with this format for time, to display in human-readable format use fieldformat with the appropriate settings.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...