Splunk Search

Convert field from Unix Epoch Time to another format

cosullivan66
Explorer

I have events that are being stored in large groups (say 10,000 at a time). The timestamp that they are given at index time is the time in which they are stored. The actual events themselves are from a wide range of times and a field within each event called ACTIONTIMESTAMP holds a unix epoch time formatted number. I want to convert this field to a regular, readable format like %H%M%S or something like that. Possibly create a new variable to store this converted time.

Here's an example of an event:
» 1/30/13
5:52:28.000 AM

EVENTLOGID=174045182 EVENTTYPE=MarketingEvent ..... ACTIONTIMESTAMP=1359553786.917

Thanks for any help

Tags (2)
0 Karma

Ayn
Legend

You could use convert to create a human readable timestamp of the ACTIONTIMESTAMP value.

A better option imho would however be to setup timestamp recognition properly so that Splunk actually uses the ACTIONTIMESTAMP value instead of setting the time when the event was indexed as its timestamp. Read more about this in the docs.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...