Splunk Search

Convert log time (epoch) to readable Date and time

raindrop18
Communicator

I have this on my log including epoch time, how I can convert the time next to msg to readable time.

"rank=msg(1489546552.151:69280424)"

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust
 ...|rex field=rank "msg\((?<epoch>\d+\.\d+)" 
 | convert ctime(epoch) 
 | table epoch

View solution in original post

woodcock
Esteemed Legend

Like this:

The setup:

| makeresults | eval rank="msg(1489546552.151:69280424)" 

The solution:

| rex field=rank "msg\((?<epoch>\d+\.\d+)"
| fieldformat epoch=strftime(epoch, "%m/%d/%Y %H:%M:%S")
0 Karma

jkat54
SplunkTrust
SplunkTrust
 ...|rex field=rank "msg\((?<epoch>\d+\.\d+)" 
 | convert ctime(epoch) 
 | table epoch

raindrop18
Communicator

thanks ,that works as expected.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...