Why is strptime not working with Calendar - Custom Visualization?

[kiran331]

Hi

I want to show the Logon time and logoff time and duration in calendar customization in human readable format but its not working when I convert epoch time in to readable format.

search i'm using:

index=cisco_wsa user=abcdk| eval time=_time | timechart span=1d min(time) as "LogonTime", max(time) as "LogoffTime"|eval Duration=(LogoffTime - LogonTime)/3600 |convert  timeformat="%m/%d/%y %H:%M:%S" ctime(*)

[jconger]

The calendar custom visualization is expecting numerical data for the values which is similar to a line chart. Basically, if it works on a line chart, it should work on the calendar as well.

[richgalloway]

Have you tried using fieldformat?

index=cisco_wsa user=acdkn002 | eval time=_time | timechart span=1d min(time) as "LogonTime", max(time) as "LogoffTime"|eval Duration=(LogoffTime - LogonTime)/3600 |fieldformat LogonTime=strftime(LogonTime,"%m/%d/%y %H:%M:%S") |fieldformat LogoffTime =strftime(LogoffTime ,"%m/%d/%y %H:%M:%S")

[kiran331]

I tried, its not working.