This may be a good use case for calculated fields. You can setup a calculated field to based on either _time or _indextime (I'll come back to a question there in a second).
Take a look at the these docs:
http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/definecalcfields
Just to be sure, are the builtin timestamps correct for the events? (From your question it sounds like they are, but from a comment earlier, it was't clear.) Getting timestamp recognition correct when the data is onboard is super critical in Splunk. (I'd argue that it's the most important on boarding issue.) This is important if you want consistency in Splunk, start here:
http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/Configuretimestamprecognition
If you're sourcetypes are setup to use structured data (IIS/JSON) take a look at TIMESTAMP_FIELDS in props.conf:
http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/Extractfieldsfromfileswithstructureddata
Once you've got _time setup correctly, now Splunk can search on timeframes properly, and then you can make a friendly field using calculated fields:
EVAL-timestamp = strftime(_time, "%Y-%m-%d %T")
BTW. A field alias only "copies" the field, it doesn't "move" a field. (And you wouldn't want it too, that would break lots of stuff). It's not the same as the rename search command, it's more like eval newfield=oldfield .
... View more
