Hello! i hope you can help me with this.
I´m trying to set as _time an epoch field located at "rt" field.
But if i try to make an timechart after eval _time=getTime, i receive following error.
strftime converts your epoch time to string and that's why it does not work. All you need is this.
index=business AND combo
| eval _time=rt/pow(10,3)
| timechart count
Please up vote and mark as answer if this works for you.
View solution in original post