Splunk Search

Time conversion

Nith1
Path Finder

Hi Team

 

I have the time in this format "startTime":1606406489009 i wanted to convert it to date-month-year hour-seconds can someone please help me with the query

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Not sure whether there is another question here - the rex extracts the digits as a number, the number represents milliseconds since epoch, time is usually stored as seconds since epoch so divide this number by 1000, this can be done with all your events with this format for time, to display in human-readable format use fieldformat with the appropriate settings.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="\"startTime\":1606406489009"
| rex "startTime\":(?<time>\d+)"
| eval seconds=time/1000
| fieldformat seconds=strftime(seconds,"%Y-%m-%d %H:%M:%S.%Q")
0 Karma

Nith1
Path Finder

Hi @ITWhisperer 

Thanks for the reply its working, but if we have all the logs with same kind for starttime how can we resolve that

 

Thanks

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not sure whether there is another question here - the rex extracts the digits as a number, the number represents milliseconds since epoch, time is usually stored as seconds since epoch so divide this number by 1000, this can be done with all your events with this format for time, to display in human-readable format use fieldformat with the appropriate settings.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...