how to group by day but with different time ?

[mah]

Hi, 

I have a table like this : 

I want to group by day and tried the commande | bucket span=1d field_date but without success. 

How can I do ? 

[ITWhisperer]

Is your field a string rather than a datetime field? Perhaps you can create a time field from the first 10 characters of the field_date?

| eval day=strptime(substr(field_date,1,10),"%Y-%m-%d")
| bin span=1d day

[mah]

Hi @ITWhisperer ,

It returns this : 

How can I write values of day field in %Y%m%d ?

[ITWhisperer]

| fieldformat day=strftime(day,"%Y%m%d")

[mah]

Thanks, 

Now I have this :

 I applied the bin command, it doesn't work. I tried the bucket command, it doesn't work too. 

| eval time=strptime(substr(field_date,1,10),"%Y-%m-%d")
| fieldformat time=strftime(time,"%Y-%m-%d")
| table time OK KO TOTAL
| bin time span=1d

[ITWhisperer · Accepted solution]

The bin is to set up buckets for a stats command - if we assume you want to sum the OK, KO and TOTAL columns by day

| eval time=strptime(substr(field_date,1,10),"%Y-%m-%d")
| fieldformat time=strftime(time,"%Y-%m-%d")
| bin time span=1d
| stats sum(OK) as OK sum(KO) as KO sum(TOTAL) as TOTAL by time

[mah]

hi @ITWhisperer ,

Exactly what I was looking for. 

I didn't know that the stat command had to be written after the bin command. That why the bin didn't work. 

Thank you very much.