I want to implement timechart with span in db sql query. But while implementation, I am getting zero result.
Basically, I want to show count with timechart.
Even, I verified that data is coming with the same query with created_timestamp column.
I don't know what step I am doing missing, while using timechart.
Timechart relies on a field called _time to hold the epoch timestamp. You need to parse the create time and store it in the _time field. Try something like this
| eval _time=strptime(created_timestamp,"%Y-%m-%d %H:%M:%S.%3N")
Timechart relies on a field called _time to hold the epoch timestamp. You need to parse the create time and store it in the _time field. Try something like this
| eval _time=strptime(created_timestamp,"%Y-%m-%d %H:%M:%S.%3N")
Thanks @ITWhisperer , Its working now. But I am getting extra date in visualization like 1 Apr to 24 Apr . I only fetched date 1 march to 1April Even I put the condition on _time, still its not working
Getting extra date in timechart. Any Solution?
Timechart uses the earliest and latest times from the search to determine the size of the x axis
Change the timeframe for the search or create your own chart
| bin span=1h _time
| chart count by _time scope