topic Changing time format in Splunk Dev

Changing time format

zacksoft — Tue, 29 Sep 2020 17:31:20 GMT

Currently I'm using a stats command to populate a few fields along with time.
The command is as follows,
stats values(session_id) as Session values(_time) as Time values(action) as Action_Performed values(success) as Rate by usage

Here I get Time in a strange format , like 1515424081.
Is there any way to change the format to something readable ?

Re: Changing time format

mayurr98 — Tue, 09 Jan 2018 11:08:55 GMT

hey @zacksoft

try this

<your_base_query> |stats values(session_id) as Session values(_time) as Time values(action) as Action_Performed values(success) as Rate by usage | eval c_time=strftime(Time,"%m/%d/%y %H:%M:%S")

Let me know if it works!

Re: Changing time format

zacksoft — Tue, 09 Jan 2018 11:17:54 GMT

@mayurr98 Perfecto !!