So I am running a Query using DBConnect. "date_provisioned"
is the column that has the time stamp. It is in the format below. I am having issues that when I remove the "timechart span=7d count by platform"
section it shows 183 events. I want to count those events based on the time. I feel like I am doing something wrong with the eval _time
section.
Please help!
Format:
2018-01-02 00:00:00.0
QUERY:
| dbxquery query="SELECT * FROM \"ESS\".\"dbo\".\"CST_itportal_provisioning\" where Year = Year(GETDATE())" connection="ESS_DB" |eval _time = date_provisioned | timechart span=7d count By platform
you need to format your date_provisioned to be in epoch for _time to work in timechart. try this
| dbxquery query="SELECT * FROM \"ESS\".\"dbo\".\"CST_itportal_provisioning\" where Year = Year(GETDATE())" connection="ESS_DB" |eval _time = strptime(date_provisioned,"%Y-%m-%d %H:%M:%S.%1N") | timechart span=7d count By platform
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
https://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Usedefaultfields#Internal_fields
Thank you!
I tried that before as well, but I see where I messed up. I had (date_provisioned,"%Y-%m-%d %H:%M:%S.%1N") but I missed the colons 😞 thanks so much for the help. It is working exactly as I want it too.
you need to format your date_provisioned to be in epoch for _time to work in timechart. try this
| dbxquery query="SELECT * FROM \"ESS\".\"dbo\".\"CST_itportal_provisioning\" where Year = Year(GETDATE())" connection="ESS_DB" |eval _time = strptime(date_provisioned,"%Y-%m-%d %H:%M:%S.%1N") | timechart span=7d count By platform
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
https://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Usedefaultfields#Internal_fields