Not able to get Date in proper format when put in Visualization

[aditsss]

Hi Everyone,

I am using below query:

index=abc ns=uio app_nameapi "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"|timechart count(RID) as "RID" by sourceagent

when I put it in line chart I am getting dates like this:

Tue March 2

Wed March 3

I want it all in proper date format.

In statics its coming in date format but when I put in line chart . Not getting proper dates.

Can someone guide me on this.

[ITWhisperer · Accepted solution]

It is not clear what you consider to be a proper time format.

_time is automatically formatted so you could rename it and specify the format you want

index=abc ns=uio app_nameapi "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"|timechart count(RID) as "RID" by sourceagent
| rename _time as time
| fieldformat time=strftime(time,"%Y/%m/%d")