I have requirement like we have custom time field ALERTDATETIME i want to display graph where my custom time field should be primary time field. This could have been easy if they asked just display ALERTDATETIME stats but they want time filter in graph where if they select last 7days or expanding to 30 days the data should be displayed based on ALERTDATETIME not the _time field. So am stuck here how to set custom time field as _time when user filtering date.
The date format of ALERTDATETIME is "%Y-%m-%d %H:%M:%S", need to convert only %Y-%m-%d. I tried something like below query but didn't work.
| eval _time=strptime(ALERTDATETIME,"%Y-%m-%d")
| stats count by _time
When the user searches for, say, 7 days, do they expect that search to return results where
ALERTDATETIME is within that 7 day window, or do they only want the resulting output to make use of
Thanks for reply!
They want to When the user searches for, say, 7 days, do they expect that search to return results where ALERTDATETIME is within that 7 day window
In that case you need to ensure the timepicker range selected encompasses the full time range of the actual
_time field that may have events with
ALERTDATETIME in the desired range. That may mean users can't select 7 days from the timepicker if they want 7 days based on
The timepicker will only define your time window based on
try using this:
base search | addinfo | eval _time=strptime(ALERTDATETIME,"%Y-%m-%d") | where _time>=info_min_time AND (info_max_time="+Infinity" OR _time<=info_max_time) | stats count by _time
that should allow for use of the time picker.