Archive

Issue with Field other than _time to represent in x-axis

Communicator

Hi,

I have to represent a different time field in the time chart. I have tried couple of options and it is not working
index="myindex" | eval DueTime = strptime('Due By',"%d.%m.%Y")|bin DueTime span=1mon |chart count over Due_Time by "Priority"
Here i get results in string and not date

  1. index="myindex" | eval DueTime = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|bin DueTime span=1mon |chart count over Due_Time by “Priority” - Here it displays date but span is not working.

Please help

Tags (1)
0 Karma
1 Solution

Legend

I don't understand field 'Due By' in strfptime function.
Every way try to invert eval and bin commands:

index="myindex" | eval Due_Time = strptime('Due By',"%d.%m.%Y") |bin Due_Time span=1mon | eval Due_Time = strftime(Due_Time,"%d.%m.%Y") |chart count over Due_Time by “Priority” 

Bye.
Giuseppe

View solution in original post

Legend

I don't understand field 'Due By' in strfptime function.
Every way try to invert eval and bin commands:

index="myindex" | eval Due_Time = strptime('Due By',"%d.%m.%Y") |bin Due_Time span=1mon | eval Due_Time = strftime(Due_Time,"%d.%m.%Y") |chart count over Due_Time by “Priority” 

Bye.
Giuseppe

View solution in original post

Communicator

Thank you! Worked the way i wanted 🙂

0 Karma