Splunk Search

Convert time

chadman
Path Finder

I'm trying to rename _time to Time and it's changing the format. I used ctime to fix it, but I only want to display it in the HH:MM format. I can I covert my ctime to only show HH:MM?

        | eval Time = _time
        | table Time "Idle Time" | convert ctime(Time)
0 Karma
1 Solution

sundareshr
Legend

Try this

| eval Time=strftime(_time, "%H:%M") | table Time, "Idle Time"

View solution in original post

sowings
Splunk Employee
Splunk Employee

_time is always in Unix epoch time. If you leave that field name alone, it will "magically" convert it to human readable for you. Using the convert function or the strftime eval function provides you with the option to "name your format".

sundareshr
Legend

Try this

| eval Time=strftime(_time, "%H:%M") | table Time, "Idle Time"

chadman
Path Finder

Thanks, that did it!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...