How do I extract the event time?

[amccallon]

I tried this but didn't work. | return _time=strftime(_time,"%Y-%m-%d %H:%M:%S")

[niketn · Accepted solution]

@amccallon... fieldformat will adjust the field value for display while retaining the time as epoch. Are you trying to do something like this?

 | fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S")
 | table _time

[amccallon]

Thank you that worked!

[niketn]

@amccallon please accept the answer, if it solved the issue for you.

[skoelpin]

Are you trying to reformat the time at search time? If so then you will need to re-index your data with the correct TIME_FORMAT attribute in props.conf

[amccallon]

Thanks Splunkers! I am trying to return a date to display. I get the epoch time when i use the return _time like above but it doesn't get reformatted to a readable date and time?

[pradeepkumarg]

what are you trying to do? _time is already available. you can just append | table _time to your search