Hi,
I have to represent a different time field in the time chart. I have tried couple of options and it is not working
index="myindex" | eval Due_Time = strptime('Due By',"%d.%m.%Y")|bin Due_Time span=1mon |chart count over Due_Time by "Priority"
Here i get results in string and not date
Please help
I don't understand field 'Due By' in strfptime function.
Every way try to invert eval and bin commands:
index="myindex" | eval Due_Time = strptime('Due By',"%d.%m.%Y") |bin Due_Time span=1mon | eval Due_Time = strftime(Due_Time,"%d.%m.%Y") |chart count over Due_Time by “Priority”
Bye.
Giuseppe
I don't understand field 'Due By' in strfptime function.
Every way try to invert eval and bin commands:
index="myindex" | eval Due_Time = strptime('Due By',"%d.%m.%Y") |bin Due_Time span=1mon | eval Due_Time = strftime(Due_Time,"%d.%m.%Y") |chart count over Due_Time by “Priority”
Bye.
Giuseppe
Thank you! Worked the way i wanted 🙂