set up a new field for timestamp - not working

[premraj_vs]

I am running a search against JSON data, and I am able to get the field I am interested in. Now, I am trying to set that field as a timestamp for charts, but it is not working.

index=idx-index-name "fields.created"="*"
| eval _time=strptime("fields.created","%Y-%m-%dT%H:%M:%SZ")
| timechart span=1d count

Value of field - "fields.created" - 2019-01-09T10:51:34.000-0500

If I remove the second line and run the command, all the events are in index time ( today ), but the records are from the last 1 month.

Can someone help me find what i am missing?

[chrisyounger · Accepted solution]

Hi @premraj_vs

Give this a try:

 index=idx-index-name "fields.created"="*"
 | eval _time=strptime('fields.created',"%Y-%m-%dT%H:%M:%SZ")
 | timechart span=1d count

Sometimes you need to use single quotes when referring to field names that have strange characters in them.

All the best

[premraj_vs]

It worked .. Thanks for the help

[chrisyounger]

OK Looks like your strptime format is wrong. Try this one instead: %Y-%m-%dT%H:%M:%S.%3Q%z

[premraj_vs]

yes i made this change