# zeek ts conversion

**URL:** <https://community.zeek.org/t/zeek-ts-conversion/5882>\
**Category:** Zeek\
**Created:** [October 30, 2019, 3:31am UTC](https://community.zeek.org/t/zeek-ts-conversion/5882 "2019-10-30T03:31:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![venkatesh\_bandari](https://avatars.discourse-cdn.com/v4/letter/v/a9a28c/32.png) [@venkatesh\_bandari](https://community.zeek.org/u/venkatesh_bandari)\
**Post date:** [October 30, 2019, 3:31am UTC](https://community.zeek.org/t/zeek-ts-conversion/5882/1 "2019-10-30T03:31:39Z")

</div>

Hello team,

we are doing a zeek poc.iam doing the integration with [splunk.in](http://splunk.in) the spunk logs i see the ts value which is not in human readable format.zeek-cut/bro-cut on the box can be used to convert ts to human readable format using -d

the question is how can i do this before sending the json logs to [splunk.is](http://splunk.is) there a way

Thanks  
Venkatesh

---

<div class="post-metadata">

**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\
**Post date:** [October 31, 2019, 12:08pm UTC](https://community.zeek.org/t/zeek-ts-conversion/5882/2 "2019-10-31T12:08:40Z")

</div>

In local.bro, add the following line…

```auto
redef LogAscii::json_timestamps = JSON::TS_ISO8601;

```

That should make your log have timestamps in ISO8601 time format which most systems natively recognize and understand.

.Seth

---

<div class="post-metadata">

**Author:** ![venkatesh\_bandari](https://avatars.discourse-cdn.com/v4/letter/v/a9a28c/32.png) [@venkatesh\_bandari](https://community.zeek.org/u/venkatesh_bandari)\
**Post date:** [November 1, 2019, 11:17am UTC](https://community.zeek.org/t/zeek-ts-conversion/5882/3 "2019-11-01T11:17:35Z")

</div>

Thank you Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/zeek-ts-conversion/5882/4 "2022-05-06T15:46:50Z")

</div>