topic Re: Is there a way to remove seconds from a table? in Splunk Search

Is there a way to remove seconds from a table?

jrevolorio — Fri, 25 Aug 2017 20:24:30 GMT

I'm trying to create a report where it shows the date and time; however, when it comes to time I just want it to display the hour and minutes, not the seconds. Is there a way to do that?

Re: Is there a way to remove seconds from a table?

Grumpalot — Fri, 25 Aug 2017 20:56:45 GMT

@jrevolorio try adding this pipe into your search your search | eval time=strftime(_time, "%H:%M") | your report

What we are doing is taking the _time field and stripping out the Hour and Minute only. If you have another field you are pulling time from you can replace _time for that field. When you create your output you will then use the time field instead.

Re: Is there a way to remove seconds from a table?

richgalloway — Fri, 25 Aug 2017 20:58:07 GMT

Use the fieldformat command. Something like this:

... | fieldformat myField=strftime(myField, "%Y-%m-%d %H:%M")

Re: Is there a way to remove seconds from a table?

DalJeanis — Fri, 25 Aug 2017 22:32:29 GMT

You can format it, the way that @richgalloway and @Grumpalot said, or you can actually change the _time to eliminate the seconds like this -

| eval _time = 60*floor(_time/60)

Under the above, the standard output for _time should hide the seconds.