How to rename _time column

[webnair]

How to rename the _time to TIME in the below query:

|inputlookup currentesdorders.csv | dedup ORDER_NUMBER | where ORDER_TOTAL =0 | fields ESD_ORDER CREATION_DATE | eval ESD_ORDER=if(ESD_ORDER="Y","ESD","Physical") | eval _time=CREATION_DATE | timechart span=1w count(CREATION_DATE) as count by ESD_ORDER

[Isaias_Garcia · Accepted solution]

try this

...| rename _time AS TIME

[Isaias_Garcia]

oh is see..same question was asked before.you may try this: http://answers.splunk.com/answers/1275/renaming-_time-field-causes-an-unwanted-result

[webnair]

Thanks for the quick answer. Th ecolumn name changes but then the time gets converted to unix format.
Hiw do I retain the date format for example: 2014-03-27