Home

Conversion of epoch / unixtimestamps within Log Analytics

%3CLINGO-SUB%20id%3D%22lingo-sub-191425%22%20slang%3D%22en-US%22%3EConversion%20of%20epoch%20%2F%20unixtimestamps%20within%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-191425%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3Bwe%20re%20using%20a%20lot%20of%20epoch%20%2F%20unixtimestamps%20(seconds%20since%201970-1-1)%20in%20our%20solution%20and%20are%20wondering%20right%20now%20if%20there%20is%20the%20possibilty%20to%20convert%20those%20timestamps%20to%20datetime%20objects%20within%20loganalytics%20queries%3F%20Unfortunately%20we%20couldn't%20find%20anything%20in%20the%20documentation%20on%20that%20matter.%20Would%20be%20great%20if%20someone%20could%20point%20us%20in%20the%20right%20direction.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-191425%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358365%22%20slang%3D%22en-US%22%3ERe%3A%20Conversion%20of%20epoch%20%2F%20unixtimestamps%20within%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358365%22%20slang%3D%22en-US%22%3E%3CP%3Emaybe%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CSPAN%3Edatatable%20(unixtime%3C%2FSPAN%3E%3CSPAN%3E%3A%3C%2FSPAN%3E%3CSPAN%3Estring%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%20%5B%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E915148798.75%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E915148799.00%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E915148799.25%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E915148799.50%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E915148799.75%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%20%5D%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eproject%3C%2FSPAN%3E%3CSPAN%3E%20todatetime(unixtime)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%2F%2F%20line%201%20of%20the%20result%20would%20be%20%22%3CSPAN%3E1998-12-31T23%3A59%3A58.000%22%3C%2FSPAN%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358131%22%20slang%3D%22en-US%22%3ERe%3A%20Conversion%20of%20epoch%20%2F%20unixtimestamps%20within%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358131%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F144906%22%20target%3D%22_blank%22%3E%40Matthias%20Stier%3C%2FA%3E%26nbsp%3B%3CBR%20%2F%3EI'm%20exactly%20looking%20for%20the%20same%20solution.%20Please%20let%20me%20know%2C%20if%20you%20found%20out%20anything%20helpful!%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

 we re using a lot of epoch / unixtimestamps (seconds since 1970-1-1) in our solution and are wondering right now if there is the possibilty to convert those timestamps to datetime objects within loganalytics queries? Unfortunately we couldn't find anything in the documentation on that matter. Would be great if someone could point us in the right direction.

3 Replies
Highlighted

Hi @Matthias Stier 
I'm exactly looking for the same solution. Please let me know, if you found out anything helpful!

Highlighted

maybe?

 

datatable (unixtime:string)
[
915148798.75,
915148799.00,
915148799.25,
915148799.50,
915148799.75
]
| project todatetime(unixtime)
 
 
// line 1 of the result would be "1998-12-31T23:59:58.000" 
 
Highlighted

@Matthias Stier 

 

Please use the following function to convert into the date and time 

unixtime_seconds_todatetime(epoch value)
 touploadtechms.png