unixtime_milliseconds_todatetime

Use the function whenever you ingest data that stores time as epoch milliseconds (for example, JSON logs from NGINX or metrics that follow the StatsD line protocol). Converting to datetime lets you bin, filter, and visualize events with the rest of your time-series data.

Usage#

Syntax#

unixtime_milliseconds_todatetime(milliseconds)

Parameters#

Name	Type	Description
`milliseconds`	`int` or `long`	Whole milliseconds since the Unix epoch. Fractional input is truncated.

Returns#

A datetime value that represents the given epoch milliseconds at UTC precision (1 millisecond).

Use case example#

The HTTP access logs keep the timestamp as epoch milliseconds and you want to convert the values to datetime.

Query

['sample-http-logs']
| extend epoch_milliseconds = toint(datetime_diff('Millisecond', _time, datetime(1970-01-01)))
| extend datetime_standard = unixtime_milliseconds_todatetime(epoch_milliseconds)
| project _time, epoch_milliseconds, datetime_standard

Run in Playground

Output

_time	epoch_milliseconds	datetime_standard
May 15, 12:09:22	1,747,303,762	2025-05-15T10:09:22Z

This query converts the timestamp to epoch milliseconds and then back to datetime for demonstration purposes.

unixtime_microseconds_todatetime: Converts a Unix timestamp expressed in whole microseconds to an APL datetime value.
unixtime_nanoseconds_todatetime: Converts a Unix timestamp expressed in whole nanoseconds to an APL datetime value.
unixtime_seconds_todatetime: Converts a Unix timestamp expressed in whole seconds to an APL datetime value.

Other query languages#

Splunk SPL users

unixtime_milliseconds_todatetime() corresponds to an eval expression that divides the epoch value by 1000 and formats the result. You skip both steps in APL because the function takes milliseconds directly.

Splunk example

| eval timestamp=strftime(epoch_ms/1000,"%Y-%m-%dT%H:%M:%SZ")

APL equivalent

| extend timestamp=unixtime_milliseconds_todatetime(epoch_ms)

ANSI SQL users

The function plays the same role as FROM_UNIXTIME() or TO_TIMESTAMP() in SQL dialects. In APL, you don’t divide by 1,000 because the function expects milliseconds.

SQL example

SELECT FROM_UNIXTIME(epoch_ms/1000) AS timestamp FROM requests;