Hello
M trying to generate the report by using the below query:-
index="xyz" source="abc" | timechart span=1h count as Transactions by host | eval Time=strftime(_time, "%H:%M") | convert timeformat="%m-%d-%y" ctime(_time) as Date
My result is in the below format : _time, Date, Time, Host
In result m getting the default _time column also. how to eliminate this _time column from the result..??
Also i need the report format as Date, Time, Host1 but the generated report file(csv) in mail has _time, Host Date Time..
how to format this..?/
Please help me out..??
Try this
index="xyz" source="abc" | timechart span=1h count as Transactions by host | eval Time=strftime(_time, "%H:%M") | convert timeformat="%m-%d-%y" ctime(_time) as Date | fields - _time | table Date, Time, *
Try this
index="xyz" source="abc" | timechart span=1h count as Transactions by host | eval Time=strftime(_time, "%H:%M") | convert timeformat="%m-%d-%y" ctime(_time) as Date | fields - _time | table Date, Time, *