Last Time Heavy Forwarder received logs from it's Source

[itsmevic]

I've pieced together some SPL that shows me the last time the forwarder has sent its log data, but need to convert the  | eval Hour =relative_time(_time,"@h") to normal date-time format, i.e.  HH:MM:SS.  Any help is greatly appreciated! 

index=_internal sourcetype=splunkd group=tcpin_connections component=Metrics
| eval sourceHost=coalesce(hostname, sourceHost)
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| fillnull version value="pre 4.2"
| rename version as Ver  arch as MachType
| fields _time,connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver MachType
| eval Indexer= splunk_server
| eval Hour=relative_time(_time,"@h")
| stats avg(tcp_KBps) as avg_TCP_KBps avg(tcp_eps) as avg_TCP_eps sum(kb) as total_KB by Hour connectType sourceIp sourceHost MachType destPort Indexer Ver

[scelikok]

Hi @itsmevic ,

You can convert it using below at the end of your query;

| convert ctime(Hour)

If this reply helps you an upvote is appreciated.