So I am running a Query using DBConnect. "date_provisioned" is the column that has the time stamp. It is in the format below. I am having issues that when I remove the "timechart span=7d count by platform" section it shows 183 events. I want to count those events based on the time. I feel like I am doing something wrong with the eval _time section.
| dbxquery query="SELECT * FROM \"ESS\".\"dbo\".\"CST_itportal_provisioning\" where Year = Year(GETDATE())" connection="ESS_DB" |eval _time = date_provisioned | timechart span=7d count By platform
I tried that before as well, but I see where I messed up. I had (date_provisioned,"%Y-%m-%d %H:%M:%S.%1N") but I missed the colons 😞 thanks so much for the help. It is working exactly as I want it too.