https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-to-truncate-time-displayed-on-chart/m-p/317449#M94960 <P>Solved by eval function</P> <P>eval _time=strftime(_time, "%y-%m-%d %I:%M:%S")</P> Tue, 29 Sep 2020 13:01:52 GMT AKG1_old1 2020-09-29T13:01:52Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-to-truncate-time-displayed-on-chart/m-p/317448#M94959 <P>Hi,</P> <P>I am tracking Splunk startup and stop through graph.</P> <P>My search: </P> <PRE><CODE>index=_audit action=splunkShuttingDown OR action=splunkStarting | timechart span=1s count by action </CODE></PRE> <P>the time displayed in graph is bit long.<BR /> Currently displayed : 2017-02-22T00:00:08.000+01:00</P> <P>I want it to truncate the part after minutes/seconds. some thing like this.<BR /> 2017-02-22 00:00 or<BR /> 2017-02-22 00:00:08</P> <P>Thanks<BR /> Ankit</P> Fri, 24 Feb 2017 10:51:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-to-truncate-time-displayed-on-chart/m-p/317448#M94959 AKG1_old1 2017-02-24T10:51:50Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-to-truncate-time-displayed-on-chart/m-p/317449#M94960 <P>Solved by eval function</P> <P>eval _time=strftime(_time, "%y-%m-%d %I:%M:%S")</P> Tue, 29 Sep 2020 13:01:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-to-truncate-time-displayed-on-chart/m-p/317449#M94960 AKG1_old1 2020-09-29T13:01:52Z