From epoch to _time for make a timechart based search.

[cpm003]

Hello! i hope you can help me with this.

I´m trying to set as _time an epoch field located at "rt" field.

But if i try to make an timechart after eval _time=getTime, i receive following error.

[arjunpkishore5 · Accepted solution]

strftime converts your epoch time to string and that's why it does not work. All you need is this.

index=business AND combo
| eval _time=rt/pow(10,3)
| timechart count

Please up vote and mark as answer if this works for you.