Splunk Search

Convert time

chadman
Path Finder

I'm trying to rename _time to Time and it's changing the format. I used ctime to fix it, but I only want to display it in the HH:MM format. I can I covert my ctime to only show HH:MM?

        | eval Time = _time
        | table Time "Idle Time" | convert ctime(Time)
0 Karma
1 Solution

sundareshr
Legend

Try this

| eval Time=strftime(_time, "%H:%M") | table Time, "Idle Time"

View solution in original post

sowings
Splunk Employee
Splunk Employee

_time is always in Unix epoch time. If you leave that field name alone, it will "magically" convert it to human readable for you. Using the convert function or the strftime eval function provides you with the option to "name your format".

sundareshr
Legend

Try this

| eval Time=strftime(_time, "%H:%M") | table Time, "Idle Time"

chadman
Path Finder

Thanks, that did it!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...