How-To: Managing timestamps

LogScale functions expect epoch timestamps that include milliseconds, but it does not account for them with a decimal point per ISO-8601.

For example, the following is a valid epoch timestamp in LogScale:

1674233057235

As a rule, epoch time stamps should have 13 digits, and no decimal places. If a time stamp has only 10 digits, or contains 10 digits before the decimal point, you should multiple the target timestamp field by 1000:

// Account for microseconds or remove decimal point in timestamp
| myTimeStamp := myTimeStamp * 1000

Once a timestamp is in the appropriate epoch format, they can be converted using formatTime(). Here's an example:

#event_simpleName=ProcessRollup2
// Convert ProcessStartTime to proper epoch format
| ProcessStartTime := ProcessStartTime * 1000
// Convert epoch Time to Human Time
| HumanTime := formatTime("%Y-%m-%d %H:%M:%S.%L", field=ProcessStartTime, locale=en_US, timezone=Z)
| select([ProcessStartTime, HumanTime, aid, ImageFileName])