topic Why is the rename command not working when using it to rename with _time field? in Splunk Search

Why is the rename command not working when using it to rename with _time field?

harsh5523 — Fri, 24 Jul 2020 22:40:19 GMT

Hello Team,

Whenever i use the rename command to rename the _time field than output comes in the binary fomart.

For Eg. :- _time is 2020/07/21 than i rename to Time 1592830387

Re: rename issue with _time

to4kawa — Fri, 24 Jul 2020 18:58:47 GMT

_time is unix_epoch_time. It displays human readable.
if _time renames other name, it displays original value.

Re: rename issue with _time

isoutamo — Fri, 24 Jul 2020 19:01:46 GMT

As @to4kawa said it's unix epoch and you should use strftime (newField, "<time format string>") to see it correctly in human readable format. See more:

https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables
Date and Time functions - Splunk Documentationdocs.splunk.com › SearchReference

r. Ismo