Is there a way to remove seconds from a table?

[jrevolorio]

I'm trying to create a report where it shows the date and time; however, when it comes to time I just want it to display the hour and minutes, not the seconds. Is there a way to do that?

[DalJeanis]

You can format it, the way that @richgalloway and @Grumpalot said, or you can actually change the _time to eliminate the seconds like this -

| eval _time = 60*floor(_time/60)

Under the above, the standard output for _time should hide the seconds.

[richgalloway]

Use the fieldformat command. Something like this:

... | fieldformat myField=strftime(myField, "%Y-%m-%d %H:%M")

[Grumpalot · Accepted solution]

@jrevolorio try adding this pipe into your search your search | eval time=strftime(_time, "%H:%M") | your report

What we are doing is taking the _time field and stripping out the Hour and Minute only. If you have another field you are pulling time from you can replace _time for that field. When you create your output you will then use the time field instead.