https://community.splunk.com/t5/Getting-Data-In/returns-both-time-and-date-together/m-p/33750#M6057 <P>Are you asking how to convert the <CODE>_time</CODE> value that you get in epoch format to something more humanly readable? In that case, use <CODE>convert ctime(earliest(_time))</CODE> for that.</P> Wed, 14 Nov 2012 11:51:58 GMT Ayn 2012-11-14T11:51:58Z https://community.splunk.com/t5/Getting-Data-In/returns-both-time-and-date-together/m-p/33749#M6056 <P>Hi,<BR /> Using _time we will get the time of the event. so by using earliest(_time), time is produced as the result. is there any function to return both date and time. i.e. time stamp together.</P> <P>thank you for your time</P> Mon, 28 Sep 2020 12:48:14 GMT https://community.splunk.com/t5/Getting-Data-In/returns-both-time-and-date-together/m-p/33749#M6056 smolcj 2020-09-28T12:48:14Z https://community.splunk.com/t5/Getting-Data-In/returns-both-time-and-date-together/m-p/33750#M6057 <P>Are you asking how to convert the <CODE>_time</CODE> value that you get in epoch format to something more humanly readable? In that case, use <CODE>convert ctime(earliest(_time))</CODE> for that.</P> Wed, 14 Nov 2012 11:51:58 GMT https://community.splunk.com/t5/Getting-Data-In/returns-both-time-and-date-together/m-p/33750#M6057 Ayn 2012-11-14T11:51:58Z https://community.splunk.com/t5/Getting-Data-In/returns-both-time-and-date-together/m-p/33751#M6058 <P>thanks AYN it worked well with ctime</P> <P>..| convert ctime(_time) as time|stats earliest(time)</P> Wed, 14 Nov 2012 12:19:36 GMT https://community.splunk.com/t5/Getting-Data-In/returns-both-time-and-date-together/m-p/33751#M6058 smolcj 2012-11-14T12:19:36Z