topic Re: TimeChart implementation with DB SQL query in Dashboards & Visualizations

How to do TimeChart implementation with DB SQL query?

dkssingh2005 — Mon, 25 Apr 2022 15:27:47 GMT

I want to implement timechart with span in db sql query. But while implementation, I am getting zero result.

Basically, I want to show count with timechart.

Even, I verified that data is coming with the same query with created_timestamp column.

I don't know what step I am doing missing, while using timechart.

Re: TimeChart implementation with DB SQL query

ITWhisperer — Mon, 25 Apr 2022 11:55:21 GMT

Timechart relies on a field called _time to hold the epoch timestamp. You need to parse the create time and store it in the _time field. Try something like this

| eval _time=strptime(created_timestamp,"%Y-%m-%d %H:%M:%S.%3N")

Re: TimeChart implementation with DB SQL query

dkssingh2005 — Mon, 25 Apr 2022 13:00:24 GMT

Thanks @ITWhisperer , Its working now. But I am getting extra date in visualization like 1 Apr to 24 Apr . I only fetched date 1 march to 1April Even I put the condition on _time, still its not working

Getting extra date in timechart. Any Solution?

Re: TimeChart implementation with DB SQL query

ITWhisperer — Mon, 25 Apr 2022 13:48:42 GMT

Timechart uses the earliest and latest times from the search to determine the size of the x axis

Change the timeframe for the search or create your own chart

| bin span=1h _time | chart count by _time scope