- Splunk Answers
- :
- Using Splunk
- :
- Splunk Dev
- :
- Re: convert unix time to human readable time
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
convert unix time to human readable time
I have unix time format on my log and wants to convert to human readable, the method using for epoch time didn't work for me.
3365196938 [http-bio-8080-exec-113] INFO user login to the system with valid account [xxx.xxx.xxx]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is that literally the exact number in your "Unix timestamp"? That's sometime in August of 2076.
My guess is that this is some sort of variant timestamp that is based on 1910. Probably a windowing method someone invented to buy time for Y2K... or to get you past the 2038 problem...? Naw, just nonsense. What version of Unix are you running?
Also, can you confirm the exact local time on your cpu of any particular timestamp, or the interval between two of them? Those three timestamps you posted are sequential numbers, so they might be log record numbers, rather than actual timestamps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3365196938 is not a valid epoch time. It seems way in the future.
How do you translate it ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try something like this:
...|rex "(?<unixtime>\d+) "|eval time=strftime(unixtime,"%Y/%m/%d %H:%M:%S")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it's populate with the same unix time format.
3365196938 [http-bio-8080-exec-113] INFO user login to the system with valid account [xxx.xxx.xxx]
3365196939 [http-bio-8080-exec-113] INFO user login to the system with valid account [xxx.xxx.xxx]
3365196940 [http-bio-8080-exec-113] INFO user login to the system with valid account [xxx.xxx.xxx]
Ihave tried epoch time conversion but that didn't work (eval te=strptime(t,"%b %d %T %Y %Z") | eval tl=strftime(te,"%b %d %T %Y %Z")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you looking to update the raw event itself with human readable timestamp? The rex command actually extracts a new field, doesn't update raw data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to the new field not raw.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you sure that the first number is actually a timestamp? When I use an epoch converter that timestamp lands in the year 2076.
But, to answer your question, you can usually just do convert ctime(your_epic_timestamp_field)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks for quick response but unfortunately didn't work for m.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what did it populate, if anything? what method were you using originally?
Wondering How to Build Resiliency in the Cloud?
Updated Data Management and AWS GDI Inventory in Splunk Observability
Introducing the Splunk Community Dashboard Challenge!
