https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23627#M4242 <P>Ya Man this did it thanks</P> Tue, 24 Jul 2012 16:00:26 GMT hartfoml 2012-07-24T16:00:26Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23622#M4237 <P>So i can build a timechart like this:</P> <PRE><CODE>| timechart limit=3 span=1m count by host useother=F </CODE></PRE> <P>But when I export the results the time format is not readable<BR /> How to I format the _time in Timechart or how do I create this kind of chart so that I can format or convert the _time </P> <P>_time sys01 sys06 srv01 srv02</P> <P>1334078460 3 2 2 3</P> <P>1334078520 2 3 2 2</P> <P>1334078580 3 2 3 3</P> <P>1334078640 3 3 3 3</P> <P>1334078700 2 3 2 2</P> <P>1334078760 2 2 2 2</P> <P>1334078820 2 2 2 2</P> Tue, 10 Apr 2012 18:39:39 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23622#M4237 hartfoml 2012-04-10T18:39:39Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23623#M4238 <P>did you try with <CODE>| convert ctime(_time)</CODE></P> Tue, 10 Apr 2012 19:28:39 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23623#M4238 MarioM 2012-04-10T19:28:39Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23624#M4239 <P>Ya thanks I tried that first thing.</P> <P>I tried | convert timeformat="%H:%M:%S" ctime(_time) AS Time | timechart limit=3 span=1m count by host useother=F</P> <P>But I didn't know how to work in the "Time" veritable</P> Tue, 10 Apr 2012 19:33:06 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23624#M4239 hartfoml 2012-04-10T19:33:06Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23625#M4240 <P>Try</P> <PRE><CODE>... | timechart limit=3 span=1m count by host useother=F | eval Time=strftime(_time,"%H:%M:%S") | table Time,* </CODE></PRE> <P>Use of <CODE>convert</CODE> is considered <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/convert">deprecated</A>, so the <CODE>eval</CODE> will accomplish the same thing, then <CODE>table</CODE> will reorder the columns.</P> Tue, 10 Apr 2012 22:26:58 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23625#M4240 tysonstewart 2012-04-10T22:26:58Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23626#M4241 <P>try to convert after the timechart.<BR /> <PRE><BR /> * | timechart span=1d count by source | convert timeformat=""%Y-%m-%d %H:%M:%S"" ctime(_time) AS date | sort _time | fields - _time | table date *<BR /> </PRE></P> Tue, 24 Jul 2012 15:06:02 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23626#M4241 yannK 2012-07-24T15:06:02Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23627#M4242 <P>Ya Man this did it thanks</P> Tue, 24 Jul 2012 16:00:26 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23627#M4242 hartfoml 2012-07-24T16:00:26Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23628#M4243 <P>Helpful description of the commands. Thanks</P> Fri, 06 Jan 2017 09:54:27 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23628#M4243 mikeydee77 2017-01-06T09:54:27Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23629#M4244 <P>@yannK , thanks for your input. <BR /> I'm not getting the exact time for the query.<BR /> For example: If I have a DateTime: <CODE>2019-12-19T15:03:20Z</CODE> I see <CODE>2019-12-19T00:00:00Z</CODE><BR /> How can I get the exact DateTime for the event?</P> <P>my query:<BR /> <CODE>eventtype="xxxxxxx" state!=null xxxx="*" | timechart count by state | convert timeformat="%Y-%m-%dT%H:%M:%SZ" ctime(_time) AS DateTime | sort _time | fields - _time | table DateTime, *</CODE></P> Tue, 24 Dec 2019 07:21:57 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-Convert-Timeformat/m-p/23629#M4244 pbankar 2019-12-24T07:21:57Z