Splunk Search

Time conversion

Nith1
Path Finder

Hi Team

 

I have the time in this format "startTime":1606406489009 i wanted to convert it to date-month-year hour-seconds can someone please help me with the query

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Not sure whether there is another question here - the rex extracts the digits as a number, the number represents milliseconds since epoch, time is usually stored as seconds since epoch so divide this number by 1000, this can be done with all your events with this format for time, to display in human-readable format use fieldformat with the appropriate settings.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="\"startTime\":1606406489009"
| rex "startTime\":(?<time>\d+)"
| eval seconds=time/1000
| fieldformat seconds=strftime(seconds,"%Y-%m-%d %H:%M:%S.%Q")
0 Karma

Nith1
Path Finder

Hi @ITWhisperer 

Thanks for the reply its working, but if we have all the logs with same kind for starttime how can we resolve that

 

Thanks

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not sure whether there is another question here - the rex extracts the digits as a number, the number represents milliseconds since epoch, time is usually stored as seconds since epoch so divide this number by 1000, this can be done with all your events with this format for time, to display in human-readable format use fieldformat with the appropriate settings.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...