Archive
Highlighted

I do not need the seconds field in time but i am unable to separate the time from Date in time chart. Please guide me on this

Explorer
eventtype=cppm-pass-authentication (cphost=10.200.22.7 OR cphost=10.200.22.8 OR cphost=10.210.22.8 OR cphost=10.210.22.7 OR cphost=10.218.192.33 OR cphost=10.218.192.34) earliest=-30d@d latest=@d [search eventtype=cppm-guest (cphost=10.200.22.7 OR cphost=10.200.22.8 OR cphost=10.210.22.8 OR cphost=10.210.22.7 OR cphost=10.218.192.33 OR cphost=10.218.192.34)  earliest=-30d@d latest=@d |fields session_id ] | append [| search index=_internal earliest=-30d | head 1000 | fields - * | fields - _* | streamstats count | bucket _time span=1d | eval count=0] | timechart count as mac_count, dc(mac_address) as unique_mac_count span=1d | streamstats avg(mac_count) as avg_mac_count sum(mac_count) as tot_mac_count avg(unique_mac_count) as avg_u_mac_count sum(unique_mac_count) as tot_u_count |eval avg_mac_count=round(avg_mac_count)|eval avg_u_mac_count=round(avg_u_mac_count ) |          table _time, avg_u_mac_count  |     rename tot_mac_count as "Total Guest MACs"| rename tot_u_count as "Total Unique Guest MACs"|    rename avg_mac_count as "Average Guest MACs"| rename mac_count as "Day's Guest MACs"|   rename avg_u_mac_count as "Average Unique Guest MACs"| rename unique_mac_count as "Day's Unique Guest MACs"
Tags (1)
0 Karma
Highlighted

Re: I do not need the seconds field in time but i am unable to separate the time from Date in time chart. Please guide me on this

SplunkTrust
SplunkTrust

Just add following to end of your search

Your search  | fieldformat _time=strftime(_time,"%m/%d/%Y")

Updated answer

Your search | eval Time=strftime(_time,"%m/%d/%Y") | table Time, "Average Unique Guest MACs"
0 Karma
Highlighted

Re: I do not need the seconds field in time but i am unable to separate the time from Date in time chart. Please guide me on this

Explorer

It is the following output nothing to be interpreted from it:

_time Average Unique Guest MACs
0NaN-NaN-NaN NaN:NaN:NaN 126
0NaN-NaN-NaN NaN:NaN:NaN 132
0NaN-NaN-NaN NaN:NaN:NaN 107
0NaN-NaN-NaN NaN:NaN:NaN 81
0NaN-NaN-NaN NaN:NaN:NaN 66
0NaN-NaN-NaN NaN:NaN:NaN 72
0NaN-NaN-NaN NaN:NaN:NaN 85
0NaN-NaN-NaN NaN:NaN:NaN 89
0NaN-NaN-NaN NaN:NaN:NaN 94
0NaN-NaN-NaN NaN:NaN:N

0 Karma
Highlighted

Re: I do not need the seconds field in time but i am unable to separate the time from Date in time chart. Please guide me on this

SplunkTrust
SplunkTrust

Try updated answer. _time is a special field and accepts only epoch time value.

0 Karma