Archive

Unable to rename _time as Time

Path Finder

Hi,

I'm trying to rename _time as Time so that it will display the timestamp in YYYY-MM-DD HH:MM:SS. But when I do rename _time AS "Time" | table Time, it will show the time as Epoch time which was the original format extracted from the log file. How do I rename and table it correctly?

Tags (1)
0 Karma
1 Solution

Communicator

I suggest that you don't do a rename of _time, try using an eval to add "Time" and then remove the _time with fields -, such as;

| eval Time = strftime(_time, "%Y-%d-%m %H:%M:%S") | fields - _time | table Time

That works for me.

View solution in original post

Path Finder

Hi Guys,

I just realized after using the suggested formats, my earliest to latest timestamp is from right to left instead of the normal left to right. How can I reversed this to go from left to right?

How do I also make the timestamp display on the x-axis? There is only label rotation in x-axis format.alt text

0 Karma

Esteemed Legend

The _time field is very special in a number of ways and one of them is that it automatically does this under the sheets:

| fieldformat _time = strftime(_time, <YourLocalRegionTimeFormatStringHere>)

You can do the same like this:

| rename _time AS Time
| fieldformat Time = strftime(Time, "%m/%d/%Y %H:%M:%S")

Path Finder

Thanks Guys!

0 Karma

Communicator

I suggest that you don't do a rename of _time, try using an eval to add "Time" and then remove the _time with fields -, such as;

| eval Time = strftime(_time, "%Y-%d-%m %H:%M:%S") | fields - _time | table Time

That works for me.

View solution in original post

Esteemed Legend

Please see my other answer below; the way to make it exactly the same is with fieldformat, not with eval.

0 Karma

SplunkTrust
SplunkTrust

Hi wuming79,

you can't rename the _time field without getting the value all f*cked up.

Instead do something like this:

yoursearch | eval TIME=strftime(_time, "%d-%m-%Y %H:%M:%S") | table TIME | rename TIME AS whateveryouwantittobe
0 Karma

Super Champion

try to do an |eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")|table time...

0 Karma