topic Bucket against field other than _time in Deployment Architecture

Bucket against field other than _time

jacqu3sy — Tue, 24 Oct 2017 21:10:28 GMT

Can I use the bucket command to group fields by time/date when extracted against a field other than _time?

I have a field called pub date in this format; 2017-10-04 09:00:27

and was hoping the following would group the events into buckets of 6 hours;

index=* | bucket pubdate span=6h | stats count by pub date

Dosent seem to work, just lists all the individual events.

kyaparla — Tue, 24 Oct 2017 21:32:19 GMT

Thats is possible, but you need to convert pubdate from string to time field like below.

| eval pubdate_time=strptime(pubdate, "%Y-%m-%d %H:%M:%S") | bin span=6h pubdate_time

jacqu3sy — Tue, 24 Oct 2017 22:01:15 GMT

that makes sense. thanks.