convert FILETIME to human readable

[cramasta]

Does anyone know of a command/formula that for converting FILETIME date/time format to something more human readable?

[Simeon]

I'm unsure of what you mean by FILETIME, but you can use the "convert" command to change the time format. An example would be to change the epoch time used by Splunk events into a human readable format. The convert ctime usage in the following example would change the epoch times in the metadata to a human readable time:

| metadata type=hosts | convert ctime(*Time)

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/convert