The searches (or macros) which last term is:
… | fieldformat "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p")
show the expected format in the table view. Although, I have a problem when the results are included in an alert email as the field "Last Connected" shows a UNIX time formatted timestamp.
As a workaround to have human readable timestamps in alert emails I'm using:
… | eval "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p")
instead of the original term.
I guess there's a good reason to use fieldformat instead of eval, but I didn't find a better way to solve my problem. Any ideas about this?
Thank you.
fieldformat allows us to keep the underlying value , only affecting how it is displayed. This is very useful for things like sorting timestamps or for example sorting by day of the week.
eval changes the underlying value . In the above it would permanently convert the integer epoch time to a string.
I think you found the ideal solution for this problem.
Yes, yes, I knew about the difference (and it's nice to confirm it). My question was more about the usage in this specific case.
Thank you 🙂