NetflowV9 from Untangle - timestamps starting from 1969?

[gsmith]

@erasedhammer
Sorry for the delay, without tagging me I forget.

As for this issue, adding on to what @BlueTeamNinja stated. I think a pipeline would be the way to go.

Here is an example.

Epoch time to readable datetime stamp

Yes, but it’s a bit of a hack. The idea is to convert the number of seconds (here in the field “unix_timestamp”) to a time period with seconds() and then add it to the UNIX epoch: rule "UNIX timestamp" when has_field("unix_timestamp") then // UNIX epoch let epoch = parse_date("1970-01-01T00:00:00.000Z", "yyyy-MM-dd'T'HH:mm:ss.SSSZ"); let ts_seconds = seconds(to_long($message.unix_timestamp)); set_field("timestamp", epoch + ts_seconds); end Of course having a function convert…

Perhaps give that a try and if you stuck just post what you have done here , I sure someone here will respond.