Home

Convert UNIX Time/EPOCH Time

%3CLINGO-SUB%20id%3D%22lingo-sub-297156%22%20slang%3D%22en-US%22%3EConvert%20UNIX%20Time%2FEPOCH%20Time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-297156%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20there%20a%20way%20to%20convert%20time%20in%20UNIX%2FEPOCH%20to%20a%20readable%20time%20format%3F%20I%20have%20the%20attached%20data%20collected%20and%20would%20like%20to%20be%20able%20to%20convert%20it.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%3C%2FP%3E%3CP%3ESean%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-297156%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECustom%20Logs%20and%20Custom%20Fields%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-297976%22%20slang%3D%22en-US%22%3ERe%3A%20Convert%20UNIX%20Time%2FEPOCH%20Time%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-297976%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThat's%20possible%2C%20using%20standard%20datetime%20calculations%2C%20but%20do%20note%20that%20the%20language%20recommendation%20for%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Fscalar-data-types%2Fdatetime%23supported-formats%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Edatetime%20datatype%3C%2FA%3Eis%20to%20use%20SO%208601%20format%2C%20and%20any%20conversion%20you%20make%20is%20%3CU%3Eyour%20responsibility%3C%2FU%3E.%3C%2FP%3E%0A%3CP%3EBased%20on%20the%20naive%20assumption%20that%20unix%20epoch%20time%20is%20the%20number%20of%20seconds%20since%201970%2C%20here's%20an%20example%20of%20how%20to%20convert%26nbsp%3Bit%20time%20to%20UTC%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3Elet%20unix_epoch_time%20%3D%201544143119%3B%0Aprint%20UTC_time%20%3D%20datetime('1970-01-01T00%3A00%3A00Z')%20%2B%20unix_epoch_time*1s%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EReferring%20to%20use%20your%26nbsp%3Battachment%2C%26nbsp%3B1544143119%20would%20be%3A%26nbsp%3B%3CSPAN%3E2018-12-07T00%3A38%3A39.000%2C%20which%20is%20more%20readable.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EConverting%20the%20other%20way%20around%20would%20be%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3Eprint%20calculated_unix_epoch_time%20%3D%20(datetime('2004-09-16T17%3A55%3A43.54Z')-datetime('1970-01-01T00%3A00%3A00Z'))%2F1s%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENote%20it%20does%20not%20take%20into%20account%20leap%20seconds%20(explained%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FUnix_time%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHTH%2C%3C%2FP%3E%0A%3CP%3ENoa%3C%2FP%3E%3C%2FLINGO-BODY%3E
Sean Hecht
Occasional Contributor

Is there a way to convert time in UNIX/EPOCH to a readable time format? I have the attached data collected and would like to be able to convert it.

 

Thanks,

Sean

 

1 Reply

Hi,

 

That's possible, using standard datetime calculations, but do note that the language recommendation for datetime datatype is to use SO 8601 format, and any conversion you make is your responsibility.

Based on the naive assumption that unix epoch time is the number of seconds since 1970, here's an example of how to convert it time to UTC:

 

let unix_epoch_time = 1544143119;
print UTC_time = datetime('1970-01-01T00:00:00Z') + unix_epoch_time*1s

 

Referring to use your attachment, 1544143119 would be: 2018-12-07T00:38:39.000, which is more readable.

Converting the other way around would be:

 

print calculated_unix_epoch_time = (datetime('2004-09-16T17:55:43.54Z')-datetime('1970-01-01T00:00:00Z'))/1s

 

Note it does not take into account leap seconds (explained here).

 

HTH,

Noa