unixtime_milliseconds_todatetime converts a Unix timestamp that’s expressed in whole milliseconds since 1970-01-01 00:00:00 UTC to an APL datetime value.
Use the function whenever you ingest data that stores time as epoch milliseconds (for example, JSON logs from NGINX or metrics that follow the StatsD line protocol). Converting to datetime lets you bin, filter, and visualize events with the rest of your time-series data.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.Splunk SPL users
Splunk SPL users
unixtime_milliseconds_todatetime() corresponds to an eval expression that divides the epoch value by 1000 and formats the result. You skip both steps in APL because the function takes milliseconds directly.ANSI SQL users
ANSI SQL users
The function plays the same role as
FROM_UNIXTIME() or TO_TIMESTAMP() in SQL dialects. In APL, you don’t divide by 1,000 because the function expects milliseconds.Usage
Syntax
Parameters
Returns
Adatetime value that represents the given epoch milliseconds at UTC precision (1 millisecond).
Use case example
The HTTP access logs keep the timestamp as epoch milliseconds and you want to convert the values to datetime. Query
This query converts the timestamp to epoch milliseconds and then back to datetime for demonstration purposes.
List of related functions
- unixtime_microseconds_todatetime: Converts a Unix timestamp expressed in whole microseconds to an APL
datetimevalue. - unixtime_nanoseconds_todatetime: Converts a Unix timestamp expressed in whole nanoseconds to an APL
datetimevalue. - unixtime_seconds_todatetime: Converts a Unix timestamp expressed in whole seconds to an APL
datetimevalue.