Deployment Architecture

Bucket against field other than _time

jacqu3sy
Path Finder

Can I use the bucket command to group fields by time/date when extracted against a field other than _time?

I have a field called pub date in this format; 2017-10-04 09:00:27

and was hoping the following would group the events into buckets of 6 hours;

index=* | bucket pubdate span=6h | stats count by pub date

Dosent seem to work, just lists all the individual events.

0 Karma
1 Solution

kyaparla
Path Finder

Thats is possible, but you need to convert pubdate from string to time field like below.

| eval pubdate_time=strptime(pubdate, "%Y-%m-%d %H:%M:%S") | bin span=6h pubdate_time

View solution in original post

0 Karma

kyaparla
Path Finder

Thats is possible, but you need to convert pubdate from string to time field like below.

| eval pubdate_time=strptime(pubdate, "%Y-%m-%d %H:%M:%S") | bin span=6h pubdate_time

View solution in original post

0 Karma

jacqu3sy
Path Finder

that makes sense. thanks.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.