Convert time

[chadman]

I'm trying to rename _time to Time and it's changing the format. I used ctime to fix it, but I only want to display it in the HH:MM format. I can I covert my ctime to only show HH:MM?

        | eval Time = _time
        | table Time "Idle Time" | convert ctime(Time)

[sowings]

_time is always in Unix epoch time. If you leave that field name alone, it will "magically" convert it to human readable for you. Using the convert function or the strftime eval function provides you with the option to "name your format".

[sundareshr · Accepted solution]

Try this

| eval Time=strftime(_time, "%H:%M") | table Time, "Idle Time"

[chadman]

Thanks, that did it!