Splunk Search

Why is the rename command not working when using it to rename with _time field?

harsh5523
New Member

Hello Team,

Whenever i use the rename command to rename the _time field than output comes in the binary fomart.

For Eg. :- _time is 2020/07/21 than i rename to Time 1592830387

Labels (1)
Tags (1)
0 Karma

to4kawa
Ultra Champion

_time is unix_epoch_time. It displays human readable.
if _time renames other name, it displays original value.

isoutamo
SplunkTrust
SplunkTrust

As @to4kawa said it's unix epoch and you should use strftime (newField, "<time format string>") to see it correctly in human readable format. See more:

r. Ismo

Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...