https://community.splunk.com/t5/Getting-Data-In/Time-Segregation-from-Timestamp/m-p/140160#M97877 <P>The field "_time" contains the epoch time of the events, and is automatically displayed at search time on the local version of your time format and timezone.</P> <P>If you want to create a new field with a different format, you can use the convert function.<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Convert">http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Convert</A><BR /> and the formats <A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Commontimeformatvariables">http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Commontimeformatvariables</A></P> <P><CODE>&lt;mysearch&gt; | convert timeformat="%A %B %d %H:%M:%S %Y" ctime(_time) AS mytime | table mytime _time _raw</CODE></P> Wed, 23 Apr 2014 16:39:21 GMT yannK 2014-04-23T16:39:21Z https://community.splunk.com/t5/Getting-Data-In/Time-Segregation-from-Timestamp/m-p/140158#M97875 <P>Could you please let me know how to extract the day of the week, month,date(dd), time of the day (hh:mm:ss),year from the pattern : mm/dd/yy hh:mm:ss - 04/23/14 23:00:22<BR /> Eg of the result : Wednesday April 23 23:00:22 2014</P> Wed, 23 Apr 2014 15:24:14 GMT https://community.splunk.com/t5/Getting-Data-In/Time-Segregation-from-Timestamp/m-p/140158#M97875 Jananee_iNautix 2014-04-23T15:24:14Z https://community.splunk.com/t5/Getting-Data-In/Time-Segregation-from-Timestamp/m-p/140159#M97876 <P>When Splunk indexes data it does some implicit field extractions like date_wday, date_month, date_mday, date_year etc.... You can form your expected output from there or you can use splunk command like convert or strftime to generate the output you need.</P> Mon, 28 Sep 2020 16:26:55 GMT https://community.splunk.com/t5/Getting-Data-In/Time-Segregation-from-Timestamp/m-p/140159#M97876 somesoni2 2020-09-28T16:26:55Z https://community.splunk.com/t5/Getting-Data-In/Time-Segregation-from-Timestamp/m-p/140160#M97877 <P>The field "_time" contains the epoch time of the events, and is automatically displayed at search time on the local version of your time format and timezone.</P> <P>If you want to create a new field with a different format, you can use the convert function.<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Convert">http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Convert</A><BR /> and the formats <A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Commontimeformatvariables">http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Commontimeformatvariables</A></P> <P><CODE>&lt;mysearch&gt; | convert timeformat="%A %B %d %H:%M:%S %Y" ctime(_time) AS mytime | table mytime _time _raw</CODE></P> Wed, 23 Apr 2014 16:39:21 GMT https://community.splunk.com/t5/Getting-Data-In/Time-Segregation-from-Timestamp/m-p/140160#M97877 yannK 2014-04-23T16:39:21Z