@jrevolorio try adding this pipe into your search your search | eval time=strftime(_time, "%H:%M") | your report
What we are doing is taking the _time field and stripping out the Hour and Minute only. If you have another field you are pulling time from you can replace _time for that field. When you create your output you will then use the time field instead.
You can format it, the way that @richgalloway and @Grumpalot said, or you can actually change the _time
to eliminate the seconds like this -
| eval _time = 60*floor(_time/60)
Under the above, the standard output for _time
should hide the seconds.
Use the fieldformat
command. Something like this:
... | fieldformat myField=strftime(myField, "%Y-%m-%d %H:%M")
@jrevolorio try adding this pipe into your search your search | eval time=strftime(_time, "%H:%M") | your report
What we are doing is taking the _time field and stripping out the Hour and Minute only. If you have another field you are pulling time from you can replace _time for that field. When you create your output you will then use the time field instead.