Why _time field on email alerts has "DDD MMM 24hh:mm:ss YYYY" when send in as Table

[deanfidel]

Sending Email as an action for an Alert and includes the result as table.

_time field is one of the columns for this table and is showing this type of format "DDD MMM 24hh:mm:ss YYYY".

Opening the Alert in Search shows a different format. "YYYY-MM-DD 24hh:mm:ss.sss"

Is there a way to format _time field in the email's inline table?

[ITWhisperer · Accepted solution]

Use the strftime() function

[deanfidel]

Thanks! strftime() function worked for the purpose.

Here's the Search.

[search criteria]
| eval mytime=strftime(_time,"%Y-%m-%d %H:%M:%S.%Q")
| table _time, _raw, mytime