Hi,
How can we split Time in two different column.
If each row has exactly two values for Time, I'd suggest this:
your base search
| eval first_time=mvindex(Time, 0), last_time=mvindex(Time, 1)
This will create two new fields, each containing one of the values from the Time field.
If each row has exactly two values for Time, I'd suggest this:
your base search
| eval first_time=mvindex(Time, 0), last_time=mvindex(Time, 1)
This will create two new fields, each containing one of the values from the Time field.