Why is the timestamp format displayed on the dashboard different from the exported PDF output?

[billycote]

I have a dashboard that I am exporting out to a PDF on a schedule. The search works fine, the dashboard looks fine, the e-mail works fine, but I have one small problem. On the dashboard I see this

2015-09-30 09:30:00     wednesday   cg1-r-fid-oma-l2    7602398 

On the PDF export I see this:

2015-09-30T09:30:00-0400 wednesday cg1-r-fid-oma-l2 7602398

I can understand what the PDF means. I just don't want to see the -0400 (timezone offset I believe) It would be much more clear if it looked just like it did on the dashboard. Is there a format somewhere that I'm missing?

[billycote · Accepted solution]

looks like it was answered in another post.

It looks like Splunk is smart about _time and shows it the way that the user would want but on the export it adds formatting characters. I imagine it would be so that someone could programatically calculate time, etc. But the answer I found and it worked was to change the format in the dashboard firt:

| eval mytime = strftime(_time, "%Y-%m-%d %H:%M:%S")