Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] how to print time with epoch formation by tshark

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 10 Jul 2008 14:45:08 -0700

On Jul 9, 2008, at 5:17 PM, Guy Harris wrote:

With the 1.0.1 or current SVN version of Wireshark, you can, on UN*X,
do something such as

	tshark -t e -o 'column.format:"Time", "%t", "XXXXXX", "%Cus:XXXXXX"'

Or you could just do

	tshark -t e -o "column.format:Time,%t,XXXXXX,%Cus:XXXXXX"

without any spaces or embedded quotes, which...

On Windows, I leave it as an exercise to the reader to figure out
whether it's possible, with the cmd.exe command interpreter, to pass
to a command a single argument that

	1) includes spaces

and

	2) includes a bunch of double-quoted strings.

...should work on Windows. Just don't put any spaces in the column heading for the XXXXXX field.