unixtime_seconds_todatetime converts a Unix timestamp that’s expressed in whole seconds since 1970-01-01 00:00:00 UTC to an APL datetime value.

Use the function whenever you ingest data that stores time as epoch seconds (for example, JSON logs from NGINX or metrics that follow the StatsD line protocol). Converting to datetime lets you bin, filter, and visualize events with the rest of your time-series data.

#For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

eval event_time = strftime(epoch, "%Y-%m-%dT%H:%M:%S")

extend event_time = unixtime_seconds_todatetime(epoch)

SELECT TO_TIMESTAMP(epoch_seconds) AS event_time FROM events;

['events']
| extend event_time = unixtime_seconds_todatetime(epoch_seconds)

#Usage

#Syntax

unixtime_seconds_todatetime(seconds)

#Parameters

#Returns

A datetime value that represents the given epoch seconds at UTC precision (1 second).

#Use case example

The HTTP access logs keep the timestamp as epoch seconds and you want to convert the values to datetime.

Query

['sample-http-logs']
| extend epoch_seconds = toint(datetime_diff('Second', _time, datetime(1970-01-01)))
| extend datetime_standard = unixtime_seconds_todatetime(epoch_seconds)
| project _time, epoch_seconds, datetime_standard

Run in Playground

Output

This query converts the timestamp to epoch seconds and then back to datetime for demonstration purposes.

#List of related functions

• unixtime_microseconds_todatetime: Converts a Unix timestamp expressed in whole microseconds to an APL datetime value.
• unixtime_milliseconds_todatetime: Converts a Unix timestamp expressed in whole milliseconds to an APL datetime value.
• unixtime_nanoseconds_todatetime: Converts a Unix timestamp expressed in whole nanoseconds to an APL datetime value.