How do I convert the format of this timestamp in Splunk?

[vamsivasili]

How do I convert 2016-06-17T14:16 to 2016-06-17 14:16:00 format in Splunk? Appreciate your help.

[gfreitas]

You can use eval strftime and strptime for those types of changes: http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/CommonEvalFunctions.

Is the time you specified in the _time field or in another field?

[vamsivasili]

It is another field I've extracted. In that case how do I convert?

[gfreitas]

If you just want to remove the "T", you can use:

| eval field2=replace(field1, "T", " ")