Home

Convert UNIX Time/EPOCH Time

%3CLINGO-SUB%20id%3D%22lingo-sub-297156%22%20slang%3D%22en-US%22%3EConvert%20UNIX%20Time%2FEPOCH%20Time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-297156%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20there%20a%20way%20to%20convert%20time%20in%20UNIX%2FEPOCH%20to%20a%20readable%20time%20format%3F%20I%20have%20the%20attached%20data%20collected%20and%20would%20like%20to%20be%20able%20to%20convert%20it.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%3C%2FP%3E%3CP%3ESean%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-297156%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECustom%20Logs%20and%20Custom%20Fields%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-297976%22%20slang%3D%22en-US%22%3ERe%3A%20Convert%20UNIX%20Time%2FEPOCH%20Time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-297976%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThat's%20possible%2C%20using%20standard%20datetime%20calculations%2C%20but%20do%20note%20that%20the%20language%20recommendation%20for%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Fscalar-data-types%2Fdatetime%23supported-formats%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Edatetime%20datatype%3C%2FA%3Eis%20to%20use%20SO%208601%20format%2C%20and%20any%20conversion%20you%20make%20is%20%3CU%3Eyour%20responsibility%3C%2FU%3E.%3C%2FP%3E%0A%3CP%3EBased%20on%20the%20naive%20assumption%20that%20unix%20epoch%20time%20is%20the%20number%20of%20seconds%20since%201970%2C%20here's%20an%20example%20of%20how%20to%20convert%26nbsp%3Bit%20time%20to%20UTC%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3Elet%20unix_epoch_time%20%3D%201544143119%3B%0Aprint%20UTC_time%20%3D%20datetime('1970-01-01T00%3A00%3A00Z')%20%2B%20unix_epoch_time*1s%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EReferring%20to%20use%20your%26nbsp%3Battachment%2C%26nbsp%3B1544143119%20would%20be%3A%26nbsp%3B%3CSPAN%3E2018-12-07T00%3A38%3A39.000%2C%20which%20is%20more%20readable.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EConverting%20the%20other%20way%20around%20would%20be%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3Eprint%20calculated_unix_epoch_time%20%3D%20(datetime('2004-09-16T17%3A55%3A43.54Z')-datetime('1970-01-01T00%3A00%3A00Z'))%2F1s%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENote%20it%20does%20not%20take%20into%20account%20leap%20seconds%20(explained%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FUnix_time%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHTH%2C%3C%2FP%3E%0A%3CP%3ENoa%3C%2FP%3E%3C%2FLINGO-BODY%3E
Sean Hecht
Occasional Contributor

Is there a way to convert time in UNIX/EPOCH to a readable time format? I have the attached data collected and would like to be able to convert it.

 

Thanks,

Sean

 

1 Reply

Hi,

 

That's possible, using standard datetime calculations, but do note that the language recommendation for datetime datatype is to use SO 8601 format, and any conversion you make is your responsibility.

Based on the naive assumption that unix epoch time is the number of seconds since 1970, here's an example of how to convert it time to UTC:

 

let unix_epoch_time = 1544143119;
print UTC_time = datetime('1970-01-01T00:00:00Z') + unix_epoch_time*1s

 

Referring to use your attachment, 1544143119 would be: 2018-12-07T00:38:39.000, which is more readable.

Converting the other way around would be:

 

print calculated_unix_epoch_time = (datetime('2004-09-16T17:55:43.54Z')-datetime('1970-01-01T00:00:00Z'))/1s

 

Note it does not take into account leap seconds (explained here).

 

HTH,

Noa

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies