https://community.splunk.com/t5/Splunk-Search/Overwrite-time/m-p/40549#M178903 <P>Can I overwrite _time with another time from one of the fields in the event? </P> Tue, 01 May 2012 20:01:13 GMT ubko 2012-05-01T20:01:13Z https://community.splunk.com/t5/Splunk-Search/Overwrite-time/m-p/40549#M178903 <P>Can I overwrite _time with another time from one of the fields in the event? </P> Tue, 01 May 2012 20:01:13 GMT https://community.splunk.com/t5/Splunk-Search/Overwrite-time/m-p/40549#M178903 ubko 2012-05-01T20:01:13Z https://community.splunk.com/t5/Splunk-Search/Overwrite-time/m-p/40550#M178904 <P>yes you can.</P> Tue, 01 May 2012 20:06:26 GMT https://community.splunk.com/t5/Splunk-Search/Overwrite-time/m-p/40550#M178904 gkanapathy 2012-05-01T20:06:26Z https://community.splunk.com/t5/Splunk-Search/Overwrite-time/m-p/40551#M178905 <P>Turns out you can.</P> <P>I'm basically doing:</P> <P>_time = strptime(real_time, "%Y%m%d%H%M%S")</P> Mon, 28 Sep 2020 11:45:43 GMT https://community.splunk.com/t5/Splunk-Search/Overwrite-time/m-p/40551#M178905 ubko 2020-09-28T11:45:43Z