topic Re: combining date fields into a single field for charting. in Dashboards & Visualizations

combining date fields into a single field for charting.

rhuss — Fri, 03 Dec 2010 02:26:15 GMT

Is it possible to somehow combine the date_year, date_month and date_mday fields into a single date field?

I need to do this for charting purposes.

ziegfried — Fri, 03 Dec 2010 02:36:53 GMT

Yes:

... | strcat date_year "-" date_month "-" date_mday date_str

... | eval datestr=date_year."-".date_month."-".date_mday

... | eval datestr=strftime(_time, "%Y-%m-%d")

I would suggest to use the last one, as it is possible that the date_* fields are missing from the event.

justinhart — Fri, 03 Dec 2010 02:37:21 GMT

Try:

| eval full_date = date_year." ".date_month." ".date_mday

You can format that in whatever way you want, the area between " " is the seperator.

This was found under the eval command reference here.