Hi
You should remove ms from you Time like this
....
| eval Time = strftime(strptime(Time, "%Y-%m-%d %H:%M:%S,%3Q"),"%Y-%m-%d %H:%M:%S")
| ....
Another option is use substr etc. as Time seems to be a string.
r. Ismo
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
Is this for the _time field?
You could reformat it with fieldformat
| fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M")