https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311586#M93369 <P>what are you trying to do? _time is already available. you can just append | table _time to your search</P> Thu, 06 Apr 2017 01:34:13 GMT pradeepkumarg 2017-04-06T01:34:13Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311585#M93368 <P>I tried this but didn't work. | return _time=strftime(_time,"%Y-%m-%d %H:%M:%S") </P> Tue, 29 Sep 2020 13:33:03 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311585#M93368 amccallon 2020-09-29T13:33:03Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311586#M93369 <P>what are you trying to do? _time is already available. you can just append | table _time to your search</P> Thu, 06 Apr 2017 01:34:13 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311586#M93369 pradeepkumarg 2017-04-06T01:34:13Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311587#M93370 <P>Are you trying to reformat the time at search time? If so then you will need to re-index your data with the correct <CODE>TIME_FORMAT</CODE> attribute in <CODE>props.conf</CODE></P> Thu, 06 Apr 2017 01:47:25 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311587#M93370 skoelpin 2017-04-06T01:47:25Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311588#M93371 <P>Thanks Splunkers! I am trying to return a date to display. I get the epoch time when i use the return _time like above but it doesn't get reformatted to a readable date and time?</P> Thu, 06 Apr 2017 14:19:53 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311588#M93371 amccallon 2017-04-06T14:19:53Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311589#M93372 <P>@amccallon... fieldformat will adjust the field value for display while retaining the time as epoch. Are you trying to do something like this?</P> <PRE><CODE> | fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S") | table _time </CODE></PRE> Thu, 06 Apr 2017 14:28:53 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311589#M93372 niketn 2017-04-06T14:28:53Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311590#M93373 <P>Thank you that worked!</P> Thu, 06 Apr 2017 15:13:06 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311590#M93373 amccallon 2017-04-06T15:13:06Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311591#M93374 <P>@amccallon please accept the answer, if it solved the issue for you.</P> Thu, 06 Apr 2017 15:50:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-event-time/m-p/311591#M93374 niketn 2017-04-06T15:50:00Z