Why is the rename command not working when using it to rename with _time field?

[harsh5523]

Hello Team,

Whenever i use the rename command to rename the _time field than output comes in the binary fomart.

For Eg. :- _time is 2020/07/21 than i rename to Time 1592830387

[to4kawa]

_time is unix_epoch_time. It displays human readable.
if _time renames other name, it displays original value.

[isoutamo]

As @to4kawa said it's unix epoch and you should use strftime (newField, "<time format string>") to see it correctly in human readable format. See more:

• https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables
• Date and Time functions - Splunk Documentationdocs.splunk.com › SearchReference

r. Ismo