I converted my timeStampLight with strftime() but all my time was formatted to 31-12-9999 23:59:59 when I table time .
My timeStampLight is actually showing Epoch time format when I table timeStampLight. The format "%d-%m-%Y %H:%M:%S" should be correct as I managed to get my timestamp for the other log.
Any idea what went wrong with this one??
Hi wuming79,
what is your timeStampLight value?
try to divide by 1000 and then apply strftime.
| eval timeStampLight=strftime(timeStampLight/1000,"%d-%m-%Y %H:%M:%S")
Bye.
Giuseppe
It looks like your timeStampLight field isn't actually an epochtime value (seconds since the epoch), but rather milliseconds since the epoch, ie epochtime*1000. So @cusello's suggestion to divide by 1000 before strftime should work for you.
ah thanks!
Hi wuming79,
what is your timeStampLight value?
try to divide by 1000 and then apply strftime.
| eval timeStampLight=strftime(timeStampLight/1000,"%d-%m-%Y %H:%M:%S")
Bye.
Giuseppe