Splunk Search
Highlighted

How do I prevent milliseconds from displaying in the _time field in search results?

New Member

Hello everyone !

I would like my search results to not display milliseconds in the _time field in the Search app, because it's useless for me. Example, I have 15:14:33:000 and I want 15:14:33.

Thank you so much for your answer.

alt text

0 Karma
Highlighted

Re: How do I prevent milliseconds from displaying in the _time field in search results?

SplunkTrust
SplunkTrust

You can set the time to your favourite format

your search |eval _time=strftime(_time,"%d/%m/%Y %H:%M:%S")

You can set it permanent in props.conf if you don't care about millisecond precision in your searches
http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/Configuretimestamprecognition

[<spec>]
TIME_FORMAT = %d/%m/%Y %H:%M:%S
0 Karma
Highlighted

Re: How do I prevent milliseconds from displaying in the _time field in search results?

New Member

Thank you for your answer, but when I write your command, I have :

NaN/NaN/0NaN 
NaN:NaN:NaN.000

After personalize, it's same problem...

0 Karma
Highlighted

Re: How do I prevent milliseconds from displaying in the _time field in search results?

SplunkTrust
SplunkTrust

Try your search|eval Time=strftime(_time,"%d/%m/%Y %H:%M:%S") |table Time , "other fields"

0 Karma
Highlighted

Re: How do I prevent milliseconds from displaying in the _time field in search results?

New Member

Thanks you so much ! It's work !

But when I write in /opt/splunk/etc/apps/search/local/props.conf

[]

TIME_FORMAT = %d/%m/%Y %H:%M:%S

It's not work... I restart Splunk, wait +12h and it's not ok...

0 Karma
Highlighted

Re: How do I prevent milliseconds from displaying in the _time field in search results?

SplunkTrust
SplunkTrust

Sorry you can ignore this part and remove this settings. This is for extracting the timestamp from your event(initially i thought so). Since your timestamp extraction is fine you don't need this.

Please see here :http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/Configuretimestamprecognition#Reconfigure_how...

0 Karma