When displaying events in a table, can I change the timeformat used to render the times?

[sideview]

In a dashboard we're working with we are displaying a table of events and the times always have 000 as the millisecond values so we dont want to waste space showing those. And we really dont need to show the year either. Probably not even the month or the day because the header says that these are all from the last few hours. Basically any space we can save on this dashboard would be great.

So is there a way that I can reformat the big times like "12/31/00 4:00:00.000 PM" ?

[sideview · Accepted solution]

Sure, although you have to realize that the values of _time are actually epochtime numbers like '1271171831.033'. The table and the events viewer UI always show _time as though the field was a string value but this is just because the UI handling that _time field specially.

You can prove this by tacking on | eval foo=_time to your search (and selecting 'foo' in the field picker popup so the 'foo' field then shows up).

But anway, you can use the convert command to convert from epochtimes to string formatted times.

index=_internal | head 3 | convert timeformat="%H:%M:%S" ctime(_time) as compact_time

That will print out a much more compact time value like "08:19:21"

(Again, if you test this in the main search UI make sure to open the Field Picker and select the 'compact_time' field or else nothing will show up. )