How could I adjust the time to only show the yyyy/mm/dd/hour/minute?

[Jennifer]

Hi, all!

Here's my current time format! How could I adjust into the format from 2022-01-20 18:21:19,448 to 2022-01-20 18:00

[isoutamo]

Hi

You should remove ms from you Time like this

....
| eval Time = strftime(strptime(Time, "%Y-%m-%d %H:%M:%S,%3Q"),"%Y-%m-%d %H:%M:%S")
| ....

Another option is use substr etc. as Time seems to be a string.

r. Ismo

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

[ITWhisperer]

Is this for the _time field?

You could reformat it with fieldformat

| fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M")