How can I display _time in my results using stats command
I get this field when I use "table _time"
Just like the image above, I want to get the time field using stats and/or eval command
The image below is how my time events look like.
Hey @EvansB,
You can simply use the below query to get the time field displayed in the stats table
| stats values(time) as time by _time
Here, I have kept _time and time as two different fields as the image displays time as a separate field. If both time and _time are the same fields, then it should not be a problem using either. But if they are different fields, and you want to use _time, then you can replace _time with time in the values function.
Hi @EvansB,
let me understand: do you want to use _time for grouping events or as a field to display?
in the first case you could use the hint of @tshah-splunk , but is useful to add a bin command before the stats to group results, otherwise you'll have too many results:
| bin _time span=1d
| stats values(*) as * by _time
if instead you need to display _time as a field, you can put it in the stats options, using some function:
In both situations, you have also, at the end, to convert _time from epochtime to human readable format using strftime.
Ciao.
Giuseppe