- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
surekhasplunk
Communicator
08-26-2019
02:04 AM
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Sukisen1981
Champion
08-26-2019
02:44 AM
something like this?
| bin span=1mon _time | stats count(type) by _time,Value,linkSpeed
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Sukisen1981
Champion
08-26-2019
02:44 AM
something like this?
| bin span=1mon _time | stats count(type) by _time,Value,linkSpeed
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
surekhasplunk
Communicator
08-26-2019
05:52 AM
Hi @Sukisen1981
Thanks for the reply my time field is called lastUpdated and the value looks like this : 2019-04-16T04:28:58+02:00
So when i try to put span=1mon it atually gives all records rather than spanning it for 1 month.
Do i need to edit the lastUpdated field to get only the date rather than the full date and time ?
Please help
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Sukisen1981
Champion
08-26-2019
06:06 AM
hi @surekhasplunk
Yes , remember I am applying the bin command on _time , but you have a custom time field, so
| eval lastUpdated=strptime(lastUpdated,"%Y-%m-%d") |eval _time=lastUpdated|bin span=1mon _time |rest of the stuff....
