Splunk Search

Why is the rename command not working when using it to rename with _time field?

harsh5523
New Member

Hello Team,

Whenever i use the rename command to rename the _time field than output comes in the binary fomart.

For Eg. :- _time is 2020/07/21 than i rename to Time 1592830387

Labels (1)
Tags (1)
0 Karma

to4kawa
Ultra Champion

_time is unix_epoch_time. It displays human readable.
if _time renames other name, it displays original value.

isoutamo
SplunkTrust
SplunkTrust

As @to4kawa said it's unix epoch and you should use strftime (newField, "<time format string>") to see it correctly in human readable format. See more:

r. Ismo

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...