I've tried a few ways, but have been unsuccessful in creating a _time field to include the datetime, and the end hour. Ex. 06/18/2021 08:00 - 08:59. I'd appreciate any assistance in getting there.
When concating, the time field converts to unix. Then I can't convert it back to CTIME.
Here's an example of the data pulled:
index=foo host=hostfoo sourcetype=sourcefoo| bin span=1h _time| table _time
try like this
| eval date=strftime(_time, "%Y/%m/%d %H:%M")
| eval hour=strftime(_time, "%H")
| eval timestamp=date." "."-"." ".hour.":"."59"
View solution in original post
Perfect thank you.