https://community.splunk.com/t5/Splunk-Search/Unable-to-extract-Time-in-search-results/m-p/502770#M139911 <P>I am able to do so with below command</P> <P>eval time=strftime(Time,"%m/%d/%y")</P> Tue, 24 Mar 2020 17:50:19 GMT ramprakash 2020-03-24T17:50:19Z https://community.splunk.com/t5/Splunk-Search/Unable-to-extract-Time-in-search-results/m-p/502767#M139908 <P>Hi All,</P> <P>I have proper timestamp logs in Splunk. I am able to extract time for all the searches except one.</P> <P>index =<EM>mtp</EM> | stats count by Activity user</P> <P>when i need count for these two fields, i am getting the result but not Time.</P> <P>Can someone please suggest.</P> Tue, 24 Mar 2020 16:49:02 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-extract-Time-in-search-results/m-p/502767#M139908 ramprakash 2020-03-24T16:49:02Z https://community.splunk.com/t5/Splunk-Search/Unable-to-extract-Time-in-search-results/m-p/502768#M139909 <P>The <CODE>stats</CODE> command discards all fields except those used in the command itself. In your example, only 'count', 'Activity', and 'user' will be available for use after <CODE>stats</CODE>. Depending on how you intend to use Time, try one of <CODE>stats count, values(_time) as Time by Activity, user</CODE> or <CODE>stats count, latest(_time) as Time by Activity, user</CODE>.</P> Tue, 24 Mar 2020 17:02:04 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-extract-Time-in-search-results/m-p/502768#M139909 richgalloway 2020-03-24T17:02:04Z https://community.splunk.com/t5/Splunk-Search/Unable-to-extract-Time-in-search-results/m-p/502769#M139910 <P>Hey Thanks it worked but i am getting time in below format.</P> <P>Activity<BR /> user<BR /> count<BR /> Time<BR /> accueil AD161 2 <STRONG>1585034778.911</STRONG><BR /> accueil DRA4D 4 <STRONG>1584974193.304</STRONG></P> Tue, 24 Mar 2020 17:41:24 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-extract-Time-in-search-results/m-p/502769#M139910 ramprakash 2020-03-24T17:41:24Z https://community.splunk.com/t5/Splunk-Search/Unable-to-extract-Time-in-search-results/m-p/502770#M139911 <P>I am able to do so with below command</P> <P>eval time=strftime(Time,"%m/%d/%y")</P> Tue, 24 Mar 2020 17:50:19 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-extract-Time-in-search-results/m-p/502770#M139911 ramprakash 2020-03-24T17:50:19Z