This message originated from Cribl Community Slack.
Click here to view the original link.
This may have been answered before but I cannot find it. Is there a way in Search if the _time value is visually represented as 2026-05-27 17:11:51.000 and I export to CSV, to keep the time format? I did an export and got the numerical value 1776932840 .
Solved
Cribl Search: Exporting _time in CSV format using extend and strftime
Best answer by jrichardsonnthdegreeio
Hello @user,
_time will likely always export as unix time, it is converted on screen for viewing purposes but remains unix time as its stored/exported. Your best bet would likely to create a new field with the extend function and then use strftime to output it in a desirable format. Here are links to Cribls documentation on both functions:
extend: https://docs.cribl.io/search/extend/#extend
strftime: https://docs.cribl.io/search/strftime/#strftimeHello @user,
_time will likely always export as unix time, it is converted on screen for viewing purposes but remains unix time as its stored/exported. Your best bet would likely to create a new field with the extend function and then use strftime to output it in a desirable format. Here are links to Cribls documentation on both functions:
extend: https://docs.cribl.io/search/extend/#extend
strftime: https://docs.cribl.io/search/strftime/#strftimeThank you.
Sign up
Already have an account? Login
Login to the community
No account yet? Create an account
Using your Cribl Curious or University Account
User Login Employee loginEnter your E-mail address. We'll send you an e-mail with instructions to reset your password.