I am running a search against JSON data, and I am able to get the field I am interested in. Now, I am trying to set that field as a timestamp for charts, but it is not working.
index=idx-index-name "fields.created"="*" | eval _time=strptime("fields.created","%Y-%m-%dT%H:%M:%SZ") | timechart span=1d count
Value of field - "fields.created" -
If I remove the second line and run the command, all the events are in index time ( today ), but the records are from the last 1 month.
Can someone help me find what i am missing?
Give this a try:
index=idx-index-name "fields.created"="*" | eval _time=strptime('fields.created',"%Y-%m-%dT%H:%M:%SZ") | timechart span=1d count
Sometimes you need to use single quotes when referring to field names that have strange characters in them.
All the best