Time conversion

[Nith1]

Hi Team

I have the time in this format "startTime":1606406489009 i wanted to convert it to date-month-year hour-seconds can someone please help me with the query

[ITWhisperer]

| makeresults
| eval _raw="\"startTime\":1606406489009"
| rex "startTime\":(?<time>\d+)"
| eval seconds=time/1000
| fieldformat seconds=strftime(seconds,"%Y-%m-%d %H:%M:%S.%Q")

[Nith1]

Hi @ITWhisperer 

Thanks for the reply its working, but if we have all the logs with same kind for starttime how can we resolve that

Thanks

[ITWhisperer · Accepted solution]

Not sure whether there is another question here - the rex extracts the digits as a number, the number represents milliseconds since epoch, time is usually stored as seconds since epoch so divide this number by 1000, this can be done with all your events with this format for time, to display in human-readable format use fieldformat with the appropriate settings.

[isoutamo]

You could found explanations for those variables here: https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables