unixtime_seconds_todatetime

Use the function whenever you ingest data that stores time as epoch seconds (for example, JSON logs from NGINX or metrics that follow the StatsD line protocol). Converting to datetime lets you bin, filter, and visualize events with the rest of your time-series data.

Usage#

Syntax#

unixtime_seconds_todatetime(seconds)

Parameters#

Name	Type	Description
`seconds`	`int` or `long`	Whole seconds since the Unix epoch. Fractional input is truncated.

Returns#

A datetime value that represents the given epoch seconds at UTC precision (1 second).

Use case example#

The HTTP access logs keep the timestamp as epoch seconds and you want to convert the values to datetime.

Query

['sample-http-logs']
| extend epoch_seconds = toint(datetime_diff('Second', _time, datetime(1970-01-01)))
| extend datetime_standard = unixtime_seconds_todatetime(epoch_seconds)
| project _time, epoch_seconds, datetime_standard

Run in Playground

Output

_time	epoch_seconds	datetime_standard
May 15, 12:09:22	1,747,303,762	2025-05-15T10:09:22Z

This query converts the timestamp to epoch seconds and then back to datetime for demonstration purposes.

unixtime_microseconds_todatetime: Converts a Unix timestamp expressed in whole microseconds to an APL datetime value.
unixtime_milliseconds_todatetime: Converts a Unix timestamp expressed in whole milliseconds to an APL datetime value.
unixtime_nanoseconds_todatetime: Converts a Unix timestamp expressed in whole nanoseconds to an APL datetime value.

Other query languages#

Splunk SPL users

unixtime_seconds_todatetime replaces the combination of eval strftime / strptime that you normally use in Splunk. Pass the epoch value directly and APL returns a datetime.

Splunk example

eval event_time = strftime(epoch, "%Y-%m-%dT%H:%M:%S")

APL equivalent

extend event_time = unixtime_seconds_todatetime(epoch)

ANSI SQL users

Most ANSI SQL engines call this conversion with FROM_UNIXTIME or TO_TIMESTAMP. The APL version has the same single-argument signature, returns a full datetime, and automatically interprets the input as seconds (not milliseconds).

SQL example

SELECT TO_TIMESTAMP(epoch_seconds) AS event_time FROM events;