Splunk Search

How do I extract the event time?

amccallon
New Member

I tried this but didn't work. | return _time=strftime(_time,"%Y-%m-%d %H:%M:%S")

Tags (2)
0 Karma
1 Solution

niketn
Legend

@amccallon... fieldformat will adjust the field value for display while retaining the time as epoch. Are you trying to do something like this?

 | fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S")
 | table _time
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@amccallon... fieldformat will adjust the field value for display while retaining the time as epoch. Are you trying to do something like this?

 | fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S")
 | table _time
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

amccallon
New Member

Thank you that worked!

0 Karma

niketn
Legend

@amccallon please accept the answer, if it solved the issue for you.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Are you trying to reformat the time at search time? If so then you will need to re-index your data with the correct TIME_FORMAT attribute in props.conf

0 Karma

amccallon
New Member

Thanks Splunkers! I am trying to return a date to display. I get the epoch time when i use the return _time like above but it doesn't get reformatted to a readable date and time?

0 Karma

pradeepkumarg
Influencer

what are you trying to do? _time is already available. you can just append | table _time to your search

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...