Bucket against field other than _time

[jacqu3sy]

Can I use the bucket command to group fields by time/date when extracted against a field other than _time?

I have a field called pub date in this format; 2017-10-04 09:00:27

and was hoping the following would group the events into buckets of 6 hours;

index=* | bucket pubdate span=6h | stats count by pub date

Dosent seem to work, just lists all the individual events.

[kyaparla · Accepted solution]

Thats is possible, but you need to convert pubdate from string to time field like below.

| eval pubdate_time=strptime(pubdate, "%Y-%m-%d %H:%M:%S") | bin span=6h pubdate_time

[jacqu3sy]

that makes sense. thanks.