I've got a search where the last line is | table time tx duration
. This is an example of the resulting table:
time tx duration
1 1574361873 467bc12de15e87be9470405eca6af475c2ba5072 2
2 1574361828 b7ed42c618358fa1ef2733b6d4538e17b705d0ab 1342
3 1574359470 6ce4d008d1a6d6873d1c8e5481ba1c4c77f2b929 1
4 1574358821 1effc91b9e809c4412f96e2582bb9fe93e22c95d 44511
5 1574358637 c387972f676d97c752f64643e38d6663ec696392 78467
The time is in epoch format, I've generated it with this line | convert mktime(job_started_at) as time timeformat="%Y-%m-%dT%H:%M:%SZ"
but I get the error Error rendering Timeline visualization: Invalid time format specified: 1574357356,1574357377,1574357421,1574357842. Supported time formats are RFC2822, ISO 8601, and epoch time
which doesn't make any sense because it's literally saying "Time is in epoch, requires epoch".
Interestingly enough, if I do
| makeresults 1
| eval abc="123", duration=100000, time=_time
| table time abc duration
Then the visualization works, but everything is in the same format. Why won't it work here? Also if I | eval time=null()
then it works by placing the start of the timeline at the beginning of the search period.
| makeresults
| eval _raw="t time tx duration
1 1574361873 467bc12de15e87be9470405eca6af475c2ba5072 2
2 1574361828 b7ed42c618358fa1ef2733b6d4538e17b705d0ab 1342
3 1574359470 6ce4d008d1a6d6873d1c8e5481ba1c4c77f2b929 1
4 1574358821 1effc91b9e809c4412f96e2582bb9fe93e22c95d 44511
5 1574358637 c387972f676d97c752f64643e38d6663ec696392 78467"
| multikv
| table time tx duration
| rename time as _time
Hi, @cdhippen
I was able to do something normal.