This sounds easy but I can't seem to figure it out. I'm creating an "Admin" dashboard and a couple of the panels are time last "x" tool ran. The most recent event received from host "x" is what I need to retrieve a time stamp from and post it in a panel.
Currently I have this
host ="10.0.33.210" | chart first(_time)
which outputs : 1418565983
How do I convert that into readable time and date?
I'm attempting to just use a single value panel.
Thanks in advance.
Try this
host ="10.0.33.210" | chart first(_time) as Time | convert ctime(Time)
Other options
host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%Y/%m/%d %H:%M:%S")
host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%+")
Try this
host ="10.0.33.210" | chart first(_time) as Time | convert ctime(Time)
Other options
host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%Y/%m/%d %H:%M:%S")
host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%+")
That worked thanks. I can't believe I couldn't figure that out.