How do I prevent milliseconds from displaying in the _time field in search results?

[Alexwii]

Hello everyone !

I would like my search results to not display milliseconds in the _time field in the Search app, because it's useless for me. Example, I have 15:14:33:000 and I want 15:14:33.

Thank you so much for your answer.

[renjith_nair]

You can set the time to your favourite format

your search |eval _time=strftime(_time,"%d/%m/%Y %H:%M:%S")

You can set it permanent in props.conf if you don't care about millisecond precision in your searches
http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/Configuretimestamprecognition

[<spec>]
TIME_FORMAT = %d/%m/%Y %H:%M:%S

[Alexwii]

Thank you for your answer, but when I write your command, I have :

NaN/NaN/0NaN 
NaN:NaN:NaN.000

After personalize, it's same problem...

[renjith_nair]

Try your search|eval Time=strftime(_time,"%d/%m/%Y %H:%M:%S") |table Time , "other fields"

[Alexwii]

Thanks you so much ! It's work !

But when I write in /opt/splunk/etc/apps/search/local/props.conf

[]

TIME_FORMAT = %d/%m/%Y %H:%M:%S

It's not work... I restart Splunk, wait +12h and it's not ok...

[renjith_nair]

Sorry you can ignore this part and remove this settings. This is for extracting the timestamp from your event(initially i thought so). Since your timestamp extraction is fine you don't need this.

Please see here :http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/Configuretimestamprecognition#Reconfigure_how...