All Apps and Add-ons

Why is strptime not working with Calendar - Custom Visualization?

Builder

Hi

I want to show the Logon time and logoff time and duration in calendar customization in human readable format but its not working when I convert epoch time in to readable format.

search i'm using:

index=cisco_wsa user=abcdk| eval time=_time | timechart span=1d min(time) as "LogonTime", max(time) as "LogoffTime"|eval Duration=(LogoffTime - LogonTime)/3600 |convert  timeformat="%m/%d/%y %H:%M:%S" ctime(*)
0 Karma

Splunk Employee
Splunk Employee

The calendar custom visualization is expecting numerical data for the values which is similar to a line chart. Basically, if it works on a line chart, it should work on the calendar as well.

0 Karma

SplunkTrust
SplunkTrust

Have you tried using fieldformat?

index=cisco_wsa user=acdkn002 | eval time=_time | timechart span=1d min(time) as "LogonTime", max(time) as "LogoffTime"|eval Duration=(LogoffTime - LogonTime)/3600 |fieldformat LogonTime=strftime(LogonTime,"%m/%d/%y %H:%M:%S") |fieldformat LogoffTime =strftime(LogoffTime ,"%m/%d/%y %H:%M:%S")
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Builder

I tried, its not working.

0 Karma