Splunk Search
Highlighted

Why does SPLUNK show Date as a number?

Explorer

Why does SPLUNK show Date as a number?

For example, data(DATETIME) in a table is "2013-12-09 18:06:12". but in SPLINK, it shows "1386579972.000".

SPLUNK doesn't read DATETIME format? or why?
I don't want to change the DB table..

Is there any way to correct in SPLUNK? help me..
I hope to see the data(DATETIME) as a date in SPLUNK..

Tags (3)
0 Karma
Highlighted

Re: Why does SPLUNK show Date as a number?

Legend

"1386579972" IS the date, it's just in another format - specifically, it's epoch, which is the number of seconds since January 1st 1970 00:00. You could check this yourself by using something like http://www.epochconverter.com/ .

I don't understand what the problem is. Splunk will parse this and set the correct timestamp, so what is the issue you're running into?

Highlighted

Re: Why does SPLUNK show Date as a number?

Explorer

I didn't know that. thank you

0 Karma
Highlighted

Re: Why does SPLUNK show Date as a number?

Motivator

Like @Ayn says, your field will be stored as an epoch time. You can then use the convert command or the strftime eval function to convert your field into a human readable format. Like so:

| convert ctime(date) as humanreadabledate
or
| eval humanreadabledate=strftime(date,"%Y-%m-%d %H:%M:%S")

Hope this helps

Highlighted

Re: Why does SPLUNK show Date as a number?

Explorer

oh~ thank you so much

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.