Funny Looking Date

[andrewkenth]

I have a search that ends with ... | bucket span=1d _time | stats count first(_time) as Date by UserName but the date is showing up as '138380400' instead of 11/07/2013. Do I need to run a function on the date field to format it?

[somesoni2 · Accepted solution]

Yes, the _time value you see is the epoch time so you would have to format the date time using one of the following.

...| convert timeformat="%m/%d/%Y" ctime(_time) AS _time

...|eval _time=strftime(_time,"%m/%d/%Y")