I'm trying to do some data mining and I keep seeing values for what appear to be date fields that make no sense to me. For example, in looking at the /opt/splunk/var/log/splunk/splunkd.log file, I would expect there to be a timestamp in the now fields. There is a long value that doesn't appear to make sense as a date value.
Is there a way to decode dates? And is there a way to do it in a saved search?
Thanks!
Not entirely sure what the question is, but yes, you can decode dates using the eval
function strftime
. I digged around in my own splunkd.log
and the values for "now" I see in events there are epoch values (seconds since 1 Jan 1970). To decode these as something human readable, use eval
and strftime
for instance like this:
index=_internal sourcetype="splunkd" | eval human_readable_now=strftime(now, "%+")
The field human_readable_now
will now hold a time value that's a bit easier on the eyes.
Not entirely sure what the question is, but yes, you can decode dates using the eval
function strftime
. I digged around in my own splunkd.log
and the values for "now" I see in events there are epoch values (seconds since 1 Jan 1970). To decode these as something human readable, use eval
and strftime
for instance like this:
index=_internal sourcetype="splunkd" | eval human_readable_now=strftime(now, "%+")
The field human_readable_now
will now hold a time value that's a bit easier on the eyes.