https://community.splunk.com/t5/Getting-Data-In/set-up-a-new-field-for-timestamp-not-working/m-p/451740#M78311 <P>I am running a search against JSON data, and I am able to get the field I am interested in. Now, I am trying to set that field as a timestamp for charts, but it is not working.</P> <PRE><CODE>index=idx-index-name "fields.created"="*" | eval _time=strptime("fields.created","%Y-%m-%dT%H:%M:%SZ") | timechart span=1d count </CODE></PRE> <P>Value of field - "fields.created" - <CODE>2019-01-09T10:51:34.000-0500</CODE></P> <P>If I remove the second line and run the command, all the events are in index time ( today ), but the records are from the last 1 month.</P> <P>Can someone help me find what i am missing?</P> Sun, 03 Feb 2019 19:36:49 GMT premraj_vs 2019-02-03T19:36:49Z https://community.splunk.com/t5/Getting-Data-In/set-up-a-new-field-for-timestamp-not-working/m-p/451740#M78311 <P>I am running a search against JSON data, and I am able to get the field I am interested in. Now, I am trying to set that field as a timestamp for charts, but it is not working.</P> <PRE><CODE>index=idx-index-name "fields.created"="*" | eval _time=strptime("fields.created","%Y-%m-%dT%H:%M:%SZ") | timechart span=1d count </CODE></PRE> <P>Value of field - "fields.created" - <CODE>2019-01-09T10:51:34.000-0500</CODE></P> <P>If I remove the second line and run the command, all the events are in index time ( today ), but the records are from the last 1 month.</P> <P>Can someone help me find what i am missing?</P> Sun, 03 Feb 2019 19:36:49 GMT https://community.splunk.com/t5/Getting-Data-In/set-up-a-new-field-for-timestamp-not-working/m-p/451740#M78311 premraj_vs 2019-02-03T19:36:49Z https://community.splunk.com/t5/Getting-Data-In/set-up-a-new-field-for-timestamp-not-working/m-p/451741#M78312 <P>Hi @premraj_vs </P> <P>Give this a try:</P> <PRE><CODE> index=idx-index-name "fields.created"="*" | eval _time=strptime('fields.created',"%Y-%m-%dT%H:%M:%SZ") | timechart span=1d count </CODE></PRE> <P>Sometimes you need to use single quotes when referring to field names that have strange characters in them.</P> <P>All the best</P> Sun, 03 Feb 2019 19:46:47 GMT https://community.splunk.com/t5/Getting-Data-In/set-up-a-new-field-for-timestamp-not-working/m-p/451741#M78312 chrisyounger 2019-02-03T19:46:47Z https://community.splunk.com/t5/Getting-Data-In/set-up-a-new-field-for-timestamp-not-working/m-p/451742#M78313 <P>It worked .. Thanks for the help</P> Sun, 03 Feb 2019 22:55:58 GMT https://community.splunk.com/t5/Getting-Data-In/set-up-a-new-field-for-timestamp-not-working/m-p/451742#M78313 premraj_vs 2019-02-03T22:55:58Z https://community.splunk.com/t5/Getting-Data-In/set-up-a-new-field-for-timestamp-not-working/m-p/451743#M78314 <P>OK Looks like your strptime format is wrong. Try this one instead: <CODE>%Y-%m-%dT%H:%M:%S.%3Q%z</CODE></P> Sun, 03 Feb 2019 23:12:37 GMT https://community.splunk.com/t5/Getting-Data-In/set-up-a-new-field-for-timestamp-not-working/m-p/451743#M78314 chrisyounger 2019-02-03T23:12:37Z https://community.splunk.com/t5/Getting-Data-In/set-up-a-new-field-for-timestamp-not-working/m-p/451744#M78315 <P>yes i made this change</P> Sun, 03 Feb 2019 23:26:25 GMT https://community.splunk.com/t5/Getting-Data-In/set-up-a-new-field-for-timestamp-not-working/m-p/451744#M78315 premraj_vs 2019-02-03T23:26:25Z