Getting Data In

I do not need the seconds field in time but i am unable to separate the time from Date in time chart. Please guide me on this

mehtas
Explorer
eventtype=cppm-pass-authentication (cphost=10.200.22.7 OR cphost=10.200.22.8 OR cphost=10.210.22.8 OR cphost=10.210.22.7 OR cphost=10.218.192.33 OR cphost=10.218.192.34) earliest=-30d@d latest=@d [search eventtype=cppm-guest (cphost=10.200.22.7 OR cphost=10.200.22.8 OR cphost=10.210.22.8 OR cphost=10.210.22.7 OR cphost=10.218.192.33 OR cphost=10.218.192.34)  earliest=-30d@d latest=@d |fields session_id ] | append [| search index=_internal earliest=-30d | head 1000 | fields - * | fields - _* | streamstats count | bucket _time span=1d | eval count=0] | timechart count as mac_count, dc(mac_address) as unique_mac_count span=1d | streamstats avg(mac_count) as avg_mac_count sum(mac_count) as tot_mac_count avg(unique_mac_count) as avg_u_mac_count sum(unique_mac_count) as tot_u_count |eval avg_mac_count=round(avg_mac_count)|eval avg_u_mac_count=round(avg_u_mac_count ) |          table _time, avg_u_mac_count  |     rename tot_mac_count as "Total Guest MACs"| rename tot_u_count as "Total Unique Guest MACs"|    rename avg_mac_count as "Average Guest MACs"| rename mac_count as "Day's Guest MACs"|   rename avg_u_mac_count as "Average Unique Guest MACs"| rename unique_mac_count as "Day's Unique Guest MACs"
Tags (1)
0 Karma

mehtas
Explorer

It is the following output nothing to be interpreted from it:

_time Average Unique Guest MACs
0NaN-NaN-NaN NaN:NaN:NaN 126
0NaN-NaN-NaN NaN:NaN:NaN 132
0NaN-NaN-NaN NaN:NaN:NaN 107
0NaN-NaN-NaN NaN:NaN:NaN 81
0NaN-NaN-NaN NaN:NaN:NaN 66
0NaN-NaN-NaN NaN:NaN:NaN 72
0NaN-NaN-NaN NaN:NaN:NaN 85
0NaN-NaN-NaN NaN:NaN:NaN 89
0NaN-NaN-NaN NaN:NaN:NaN 94
0NaN-NaN-NaN NaN:NaN:N

0 Karma

somesoni2
Revered Legend

Try updated answer. _time is a special field and accepts only epoch time value.

0 Karma

somesoni2
Revered Legend

Just add following to end of your search

Your search  | fieldformat _time=strftime(_time,"%m/%d/%Y")

Updated answer

Your search | eval Time=strftime(_time,"%m/%d/%Y") | table Time, "Average Unique Guest MACs"
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>