Splunk Search

convert FILETIME to human readable


Does anyone know of a command/formula that for converting FILETIME date/time format to something more human readable?

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

I'm unsure of what you mean by FILETIME, but you can use the "convert" command to change the time format. An example would be to change the epoch time used by Splunk events into a human readable format. The convert ctime usage in the following example would change the epoch times in the metadata to a human readable time:

| metadata type=hosts | convert ctime(*Time)