I tried this but didn't work. | return _time=strftime(_time,"%Y-%m-%d %H:%M:%S")
@amccallon... fieldformat will adjust the field value for display while retaining the time as epoch. Are you trying to do something like this?
| fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S")
| table _time
@amccallon... fieldformat will adjust the field value for display while retaining the time as epoch. Are you trying to do something like this?
| fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S")
| table _time
Thank you that worked!
@amccallon please accept the answer, if it solved the issue for you.
Are you trying to reformat the time at search time? If so then you will need to re-index your data with the correct TIME_FORMAT
attribute in props.conf
Thanks Splunkers! I am trying to return a date to display. I get the epoch time when i use the return _time like above but it doesn't get reformatted to a readable date and time?
what are you trying to do? _time is already available. you can just append | table _time to your search