How do I get a time curve with field values?

[WXY]

Hello.

Now, I must get a time curve using a field value .

My data has these fields:_time,CreateDate

There is a data : 2018-09-18 20:30:04 , CreateDate="2018-09-18 01:04:19.95", EndDate="2018-09-18 09:16:47.813"

"2018-09-18 20:30:04 " is _time,

"2018-09-18 01:04:19.95" is CreateDate,

I want to get a time curve using the CreateDate field.

What should I do ?

[gcusello]

Hi WXY,
if you want to span events every hour, try something like this:

your_search
| eval CreateDate=strptime(CreateDate,"%Y-%m-%d %H:%M:%S.%N")
| bin span=1h CreateDate
| stats count BY CreateDate
| eval CreateDate=strftime(CreateDate,"%Y-%m-%d %H:%M:%S.%N")

Bye.
Giuseppe

[renjith_nair]

@WXY,

Try

"your search" |eval _time=strptime(CreateDate,"%Y-%m-%d %H:%M:%S.%N") |timechart "field you want to chart"