Splunk Search
Highlighted

Time format conversion

Explorer

I need to convert _time (in this format: 12/1/12 12:00:00.000 AM) to milliseconds since 1970 (unix time). I'm using convert timeformat="%s" ctime(_time) AS timeInUTC but that seems to return the wrong results...

For example, 12/1/12 12:00:00.000 AM ----> 1354341600 (Fri Jan 16 1970 10:12:21 GMT-0600 (CST))

Tags (4)
0 Karma
Highlighted

Re: Time format conversion

Motivator

Unix epoc time is seconds since 1970-01-01, not milliseconds.

I don't know where you are getting your calculation from, because the number is correct:

raj@huey[pts/1 2013-07-22 23:24:00]:~$ date -d "1 jan 1970 1354341600 seconds"
Sat Dec  1 05:00:00 GMT 2012