How-To: Managing timestamps

LogScale functions expect epoch timestamps that include milliseconds, but it does not account for them with a decimal point per ISO-8601.

For example, the following is a valid epoch timestamp in LogScale:


As a rule, epoch time stamps should have 13 digits, and no decimal places. If a time stamp has only 10 digits, or contains 10 digits before the decimal point, you should multiple the target timestamp field by 1000:

// Account for microseconds or remove decimal point in timestamp
| myTimeStamp := myTimeStamp * 1000

Once a timestamp is in the appropriate epoch format, they can be converted using formatTime(). Here's an example:

// Convert ProcessStartTime to proper epoch format
| ProcessStartTime := ProcessStartTime * 1000
// Convert epoch Time to Human Time
| HumanTime := formatTime("%Y-%m-%d %H:%M:%S.%L", field=ProcessStartTime, locale=en_US, timezone=Z)
| select([ProcessStartTime, HumanTime, aid, ImageFileName])
Results of using formatTime() to convert a timestamp


LogScale will automatically convert displayed timestamps to match your browsers default timezone. This default can be changed in your LogScale profile, or you can change it ad hoc by using the dropdown selector. All timestamps are stored in UTC.