Splunk Search

Is there a way to format the _time field?

echojacques
Builder

Is there a way to format the "_time" field? I currently use _time in many of my dashboards and searches; however, it is formatted differently depending on the sourcetype.

My attempt to standardize the output of _time below doesn't work:

sourcetype="mysource" | table _time("%m/%d/%y %I:%M:%S %p") field1 field2 field3

Does anyone know how to do this?

Thanks!

Tags (2)
1 Solution

echojacques
Builder

I solved my own question, this worked:

sourcetype="mysource" | eval time=strftime(_time, "%m/%d/%y %I:%M:%S:%p") | table time field1 field2 field3

Although I still think you should be able to format _time directly without the use of an eval 🙂

View solution in original post

manus
Communicator

I believe the implicit answer to the question is "No".

If you want to display _time the way you want, you have to do it in another field.

0 Karma

echojacques
Builder

I solved my own question, this worked:

sourcetype="mysource" | eval time=strftime(_time, "%m/%d/%y %I:%M:%S:%p") | table time field1 field2 field3

Although I still think you should be able to format _time directly without the use of an eval 🙂

dwaddle
SplunkTrust
SplunkTrust

It's been my experience that | table _time ... will format _time into a sane value anyway. At least directly in the search app. It may act different in a dashboard. But, if you want a specific time format your strftime is a great approach.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...