https://community.splunk.com/t5/Getting-Data-In/Time-format-in-email-alert/m-p/287510#M54910 <P>Search AAA||rename _time as UpTime |fieldformat UpTime=strftime(UpTime, "%D %H:%M:%S") |Table UpTime Info</P> <P>It works well in browser. like:</P> <P>10/23/15 08:06:49 Info1<BR /> 10/23/15 10:02:20 Info2</P> <P>However, when I set it as a scheduled alert, in the email I received,</P> <P>1445602009 Info1<BR /> 1445608940 Info2</P> <P>How to fix this?</P> <P>Thanks<BR /> Allen</P> Fri, 23 Oct 2015 14:56:14 GMT AllenZhang 2015-10-23T14:56:14Z https://community.splunk.com/t5/Getting-Data-In/Time-format-in-email-alert/m-p/287510#M54910 <P>Search AAA||rename _time as UpTime |fieldformat UpTime=strftime(UpTime, "%D %H:%M:%S") |Table UpTime Info</P> <P>It works well in browser. like:</P> <P>10/23/15 08:06:49 Info1<BR /> 10/23/15 10:02:20 Info2</P> <P>However, when I set it as a scheduled alert, in the email I received,</P> <P>1445602009 Info1<BR /> 1445608940 Info2</P> <P>How to fix this?</P> <P>Thanks<BR /> Allen</P> Fri, 23 Oct 2015 14:56:14 GMT https://community.splunk.com/t5/Getting-Data-In/Time-format-in-email-alert/m-p/287510#M54910 AllenZhang 2015-10-23T14:56:14Z https://community.splunk.com/t5/Getting-Data-In/Time-format-in-email-alert/m-p/287511#M54911 <P>First, open a support ticket for this because it is surely a bug. Second, switch <CODE>fieldformat</CODE> to <CODE>eval</CODE> and see if that works around it.</P> Fri, 23 Oct 2015 15:50:55 GMT https://community.splunk.com/t5/Getting-Data-In/Time-format-in-email-alert/m-p/287511#M54911 woodcock 2015-10-23T15:50:55Z