Issue with Field other than _time to represent in x-axis

[k_harini]

Hi,

I have to represent a different time field in the time chart. I have tried couple of options and it is not working
index="myindex" | eval Due_Time = strptime('Due By',"%d.%m.%Y")|bin Due_Time span=1mon |chart count over Due_Time by "Priority"
Here i get results in string and not date

1. index="myindex" | eval Due_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|bin Due_Time span=1mon |chart count over Due_Time by “Priority” - Here it displays date but span is not working.

Please help

[gcusello · Accepted solution]

I don't understand field 'Due By' in strfptime function.
Every way try to invert eval and bin commands:

index="myindex" | eval Due_Time = strptime('Due By',"%d.%m.%Y") |bin Due_Time span=1mon | eval Due_Time = strftime(Due_Time,"%d.%m.%Y") |chart count over Due_Time by “Priority” 

Bye.
Giuseppe

[k_harini]

Thank you! Worked the way i wanted 🙂