https://community.splunk.com/t5/Splunk-Search/Why-is-entry-time-not-displaying/m-p/598937#M208525 <P>When a user is added i need the time to be recorded and displayed in a field called used_added. I created the field name and can see if in the csv table but there is no time per entry.<BR /><BR /></P> <LI-CODE lang="markup">&lt;query&gt; | inputlookup USB.csv | eval user_added = strftime(_time, "%Y-%d-%m %H:%M:%S") | append [ | makeresults | eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$" ] | fields - _time | table user_added, user_added, user, category, department, description, revisit, status | lookup lookup_ims user as user OUTPUT category department | outputlookup USB.csv &lt;/query&gt;</LI-CODE> Mon, 23 May 2022 16:37:23 GMT Italy1358 2022-05-23T16:37:23Z https://community.splunk.com/t5/Splunk-Search/Why-is-entry-time-not-displaying/m-p/598937#M208525 <P>When a user is added i need the time to be recorded and displayed in a field called used_added. I created the field name and can see if in the csv table but there is no time per entry.<BR /><BR /></P> <LI-CODE lang="markup">&lt;query&gt; | inputlookup USB.csv | eval user_added = strftime(_time, "%Y-%d-%m %H:%M:%S") | append [ | makeresults | eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$" ] | fields - _time | table user_added, user_added, user, category, department, description, revisit, status | lookup lookup_ims user as user OUTPUT category department | outputlookup USB.csv &lt;/query&gt;</LI-CODE> Mon, 23 May 2022 16:37:23 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-entry-time-not-displaying/m-p/598937#M208525 Italy1358 2022-05-23T16:37:23Z https://community.splunk.com/t5/Splunk-Search/Why-is-entry-time-not-displaying/m-p/598949#M208530 <P>The user_added field is in a separate event from the other fields because of the <FONT face="courier new,courier">append</FONT> command.&nbsp; What's more, I believe the _time field will be null since there is no event with such a field when user_added is defined.&nbsp; Consider using <FONT face="courier new,courier">now()</FONT>, instead.</P> Mon, 23 May 2022 17:27:54 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-entry-time-not-displaying/m-p/598949#M208530 richgalloway 2022-05-23T17:27:54Z