_time field in not in proper format when display inside the Dashboard Studio?

[syazwani]

Hi,

I need help to fine tuned my SPL Query. _time field is not properly formatted when we configure it in dashboard.

index=sslvpn sourcetype="sslvpnsourcetype"  action=failure
| iplocation accessIP
| search Country ="Canada"
| stats values(accessIP), count by user, _time, reason
| eval _time=strftime(_time, "%d/%m/%Y %I:%M:%S %p")
| table _time, user, values(accessIP), reason, count
| rename user as Username, values(accessIP) as "Access IP", reason as "Reason", count as Count

This is the result table(_time column) when running on search and reporting app:

This is the result (_time column) when we configure in dashboard (Dashboard Studio):

Please assist us. Thank you.

[syazwani · Accepted solution]

found the silly mistake... need to rename the _time column

| table _time, user, values(accessIP), reason, count
| rename user as Username, values(accessIP) as "Access IP", reason as "Reason",
 _time as Time

 and it worked.....