How do I sum by strftime day?

[timmoammo]

Hello,

A simple questions I think.......

I'm moving my _time by 6 hours and creating newTime then using strftime to look at the results.

I then want to sum GJ by day of the newTime/strftime and then find the max of this?

This is the part of the search that isn't working

eval newTime = relative_time(_time, "-6h")

| eval n=strftime(newTime , "%Y/%m/%d-%T")
| stats sum(GJ) as MaxDay BY n_day

Any help is appreciated

[lguinn2]

Try this - just use n instead of n_day

eval newTime = relative_time(_time, "-6h")
...
| eval n=strftime(newTime , "%Y/%m/%d-%T") 
| stats sum(GJ) as MaxDay BY n

[timmoammo]

Thanks for response however this doesn't seem to work.

The bit I'm struggling with is summing by day in the adjusted strftime.

i.e. I want to sum the GJ by day (in STRFtime) and then get the max of this