https://community.splunk.com/t5/Reporting/Why-am-I-unable-to-use-strptime-function/m-p/630465#M11819 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/240743">@POR160893</a>,</P><P>_time is already in epochtime, even if is displayed in human readable, so you can directlòy use it in timechart:</P><LI-CODE lang="markup">index="ABC" | timechart span=15m count</LI-CODE><P>if instead you want to list all _time in epochtime yu can use rename:</P><LI-CODE lang="markup">index="ABC" | bin span=15m _time | rename _time AS time | table time</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Fri, 10 Feb 2023 15:09:28 GMT gcusello 2023-02-10T15:09:28Z https://community.splunk.com/t5/Reporting/Why-am-I-unable-to-use-strptime-function/m-p/630463#M11818 <P>Hi,</P> <P>I am unable to use strptime() here correctly.<BR /><BR />My code is:<BR />index="ABC"<BR />| eval time=strptime(_time, "%Y-%m-%dT%H:%M:%S")<BR />| bin time span=15m<BR />| table time<BR /><BR />But the table has no output .....<BR /><BR />Can you please help?<BR />Thanks!</P> Fri, 10 Feb 2023 17:42:55 GMT https://community.splunk.com/t5/Reporting/Why-am-I-unable-to-use-strptime-function/m-p/630463#M11818 POR160893 2023-02-10T17:42:55Z https://community.splunk.com/t5/Reporting/Why-am-I-unable-to-use-strptime-function/m-p/630465#M11819 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/240743">@POR160893</a>,</P><P>_time is already in epochtime, even if is displayed in human readable, so you can directlòy use it in timechart:</P><LI-CODE lang="markup">index="ABC" | timechart span=15m count</LI-CODE><P>if instead you want to list all _time in epochtime yu can use rename:</P><LI-CODE lang="markup">index="ABC" | bin span=15m _time | rename _time AS time | table time</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Fri, 10 Feb 2023 15:09:28 GMT https://community.splunk.com/t5/Reporting/Why-am-I-unable-to-use-strptime-function/m-p/630465#M11819 gcusello 2023-02-10T15:09:28Z