Security

How can I change the event time (_time) format in the Splunk web UI?

ianshefferman
Explorer

I'm looking to change the format of the default Time column on the left, containing the _time field, in the regular event view from search results. All the answers I've seen cover changing the locale, but instead I want to remove all milliseconds. None of my logs record to millisecond precision so I'd prefer to just remove them globally if at all possible. I'd like to change the global time format to "%m/%d/%y %I:%M:%S %p". Also, I only want/need to change this in the web UI.

I don't mind editing some of the files by hand as this is just a personal installation of Splunk.

I am running 6.1.2.

Tags (3)

somesoni2
Revered Legend
0 Karma

strive
Influencer
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...