How to do TimeChart implementation with DB SQL query?

[dkssingh2005]

I want to implement timechart with span in db sql query. But while implementation, I am getting zero result.

Basically, I want to show count with timechart.

Even, I verified that data is coming with the same query with created_timestamp column. 

I don't know what step I am doing missing, while using timechart.

[ITWhisperer · Accepted solution]

Timechart relies on a field called _time to hold the epoch timestamp. You need to parse the create time and store it in the _time field. Try something like this

| eval _time=strptime(created_timestamp,"%Y-%m-%d %H:%M:%S.%3N")

[dkssingh2005]

Thanks @ITWhisperer , Its working now. But I am getting extra date in visualization like 1 Apr to 24 Apr . I only fetched  date 1 march  to 1April Even I put the condition on _time, still its not working

Getting extra date in timechart. Any Solution?

[ITWhisperer]

Timechart uses the earliest and latest times from the search to determine the size of the x axis

Change the timeframe for the search or create your own chart

| bin span=1h _time
| chart count by _time scope