https://community.splunk.com/t5/Splunk-Search/Convert-time/m-p/229343#M67905 <P>Thanks, that did it!</P> Mon, 15 Aug 2016 17:22:27 GMT chadman 2016-08-15T17:22:27Z https://community.splunk.com/t5/Splunk-Search/Convert-time/m-p/229341#M67903 <P>I'm trying to rename _time to Time and it's changing the format. I used ctime to fix it, but I only want to display it in the HH:MM format. I can I covert my ctime to only show HH:MM?</P> <PRE><CODE> | eval Time = _time | table Time "Idle Time" | convert ctime(Time) </CODE></PRE> Mon, 15 Aug 2016 17:17:37 GMT https://community.splunk.com/t5/Splunk-Search/Convert-time/m-p/229341#M67903 chadman 2016-08-15T17:17:37Z https://community.splunk.com/t5/Splunk-Search/Convert-time/m-p/229342#M67904 <P>Try this</P> <PRE><CODE>| eval Time=strftime(_time, "%H:%M") | table Time, "Idle Time" </CODE></PRE> Mon, 15 Aug 2016 17:20:28 GMT https://community.splunk.com/t5/Splunk-Search/Convert-time/m-p/229342#M67904 sundareshr 2016-08-15T17:20:28Z https://community.splunk.com/t5/Splunk-Search/Convert-time/m-p/229343#M67905 <P>Thanks, that did it!</P> Mon, 15 Aug 2016 17:22:27 GMT https://community.splunk.com/t5/Splunk-Search/Convert-time/m-p/229343#M67905 chadman 2016-08-15T17:22:27Z https://community.splunk.com/t5/Splunk-Search/Convert-time/m-p/229344#M67906 <P>_time is always in Unix epoch time. If you leave that field name alone, it will "magically" convert it to human readable for you. Using the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Convert">convert</A> function or the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">strftime eval</A> function provides you with the option to "name your format". </P> Mon, 15 Aug 2016 17:23:24 GMT https://community.splunk.com/t5/Splunk-Search/Convert-time/m-p/229344#M67906 sowings 2016-08-15T17:23:24Z