Check out strftime.org, and the related strptime
function used with eval
Something on the order of this (pulled the microseconds out of your rex
, since Unix epoch time has no concept of subsecond intervals):
| rex field=_raw "timeStamp\>(?<timeStamp>[^\.]+)\.\d+Z"
| eval unixepoch=strptime(timeStamp,"%Y-%m-%dT%H:%M:%S")
from User warren – Stack Overflow https://stackoverflow.com/questions/70802593/splunk-extract-string-and-convert-it-to-date-format/70803673#70803673
via IFTTT