using _time in a scheduled search

[kagouros1]

Hi,

I have the following problem and am wondering if this is a bug or am I doing something wrong:
I use a scheduled search to find some events with a specific windows error ID. Then I look at it as a table using:

|table _time,

No I created a scheduled search based on that, where I send the result as an email with a csv-attachment.
In the csv-attachment (as opposed to the interactive version) I get the _time column filled in epoch (seconds since 1970) format instead of a human readable form that I get in the search app. Is this a bug or do I have to do something to make this work properly. Everything on 5.0.3.

Cheers,

Konstantin

[linu1988]

Hello Konstantin,
I seems like that _time is converted to the epoch format. But if you want to show it in the conventional format. Please use the strftime() fuction before you do the table

eval TimeStamp=strftime(_time,"%d/%m/%y %H:%M:%s %p")|table TimeStamp,

Thanks

[martin_mueller]

In the search app you get a humanly readable conversion for _time by automagic, underneath it's epoch seconds there as well. You can verify this by adding | eval foo = _time to some query, it will show epoch seconds for fóo and humanly readable for _time.

Manually, this for-view formatting without changing the underlying value is invoked by the SPL command fieldformat, see more explanation there.

[linu1988]

Please accept the answer if it was the solution/helpful!! Thanks

[linu1988]

Happy to Help!! 🙂

[kagouros1]

Thanks this fixes my problem. Just wondering why it is not converted to epoch if I do this from the search app. However I can work with this 🙂