Why is timestamp format different in csv attachment?

[xiantros]

Hi All,

We are using Splunk Cloud with Enterprise Security and we have a strange issue with csv attachments that are being sent using the "Send email" alert action. The timestamp is quite different in the attached csv, compared to the search results and exported events.

Timestamp in email attachment (csv): "Sat Jun 24 08:08:40 2023"

Timestamp in search results: "2023-06-24 08:08:40"
Timestamp in exported results (as csv): "2023-06-24T08:08:40.000+0000"

Ideally we would like to have the same timestamp format as in the search results. 

Grateful if anyone could shed some light on this - we could raise a ticket with Splunk support but we thought this might be quicker! Thank you!

[meetmshah]

Hello @xiantros, Can you please try explicitly using strftime function and verify if it helps? Example below - 

eval Time=strftime(_time,"%m/%d/%y %H:%M:%S")

 
Please accept the answer if that helps!