https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170274#M48723 <P>I can't seem to convert epoch time when using timechart. I'm trying to get each users first logon of the day over a period of time. Here's my search:</P> <P>sourcetype="wineventlog:security" NOT Account_Name="*$" EventCode=4624 | timechart span=1d min(_time) as FirstLogon by user | convert ctime(FirstLogon)</P> <P>I could use a fresh set of eyes on this. Any help would be appreciated!</P> Mon, 28 Sep 2020 16:00:49 GMT dpoon 2020-09-28T16:00:49Z https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170274#M48723 <P>I can't seem to convert epoch time when using timechart. I'm trying to get each users first logon of the day over a period of time. Here's my search:</P> <P>sourcetype="wineventlog:security" NOT Account_Name="*$" EventCode=4624 | timechart span=1d min(_time) as FirstLogon by user | convert ctime(FirstLogon)</P> <P>I could use a fresh set of eyes on this. Any help would be appreciated!</P> Mon, 28 Sep 2020 16:00:49 GMT https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170274#M48723 dpoon 2020-09-28T16:00:49Z https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170275#M48724 <P>which version of splunk are you using?</P> Fri, 28 Feb 2014 16:04:37 GMT https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170275#M48724 linu1988 2014-02-28T16:04:37Z https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170276#M48725 <P>I'm using 6.0</P> Fri, 28 Feb 2014 16:08:03 GMT https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170276#M48725 dpoon 2014-02-28T16:08:03Z https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170277#M48726 <P>Try this</P> <PRE><CODE> sourcetype="wineventlog:security" NOT Account_Name="*$" EventCode=4624| eval FirstLogon=strftime(_time, "%m/%d/%y %H:%M:%S")| timechart span=5m last(FirstLogon) as FirstLogon by user </CODE></PRE> Fri, 28 Feb 2014 16:12:02 GMT https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170277#M48726 somesoni2 2014-02-28T16:12:02Z https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170278#M48727 <P>Thank you. Got it working, but had to use 'last(FirstLogon)' instead of 'first(FirstLogon)' since first was pulling the latest logon of the day.</P> Fri, 28 Feb 2014 16:50:54 GMT https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170278#M48727 dpoon 2014-02-28T16:50:54Z https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170279#M48728 <P>My bad, I overlooked it. Will update the answer.</P> Fri, 28 Feb 2014 16:59:56 GMT https://community.splunk.com/t5/Splunk-Search/Trouble-converting-time-epoch-when-using-timechart/m-p/170279#M48728 somesoni2 2014-02-28T16:59:56Z