I have a Splunk query that does a lot of computation and eventually returns only two calculated fields: _time and STORE_ID via the table command.
The _time field is formatted exactly like the the built-in _time field (e.g., "2022-01-17 23:50:25,897").
I want to do a timechart showing the count of how many times each unique STORE_ID appears in a given time bucket, using my calculated _time variable to fill the buckets. What do I put in the timechart clause to accomplish this?
You'll see _time again formatted as a datetime string but with the value of "a day ago".
It's still a nummerical value internally and you can do normal arithmetics on it (contrary to string dates which you have to parse first with strptime if you want to modify it in any way) but if the field is called _time, splunk's webui automatically displays it as if you called fieldformat on it with strftime().
So the question is whether your calculated _time is indeed a string date with the format it shows or is it just a nummerical field which is conveniently displayed by webui.
Try renaming the field and see if the shown value changes to a number.
As richgalloway stated _time is and epoch that splunk automagicly convert to the format you see in the GUI. Also the _time you see in the GUI is based on your regional settings (e.g your events could be GMT+0 and _time shows the GMT+5 conversion). You can check there "real" _time value when you do something like "| eval my_time = _time", the my_time will show the epoch time (which is based on UTC).
As for your case, if your time field is a calculated one that is not in epoch format and want to use that in a time chart you can use this:
The timechart command needs only the _time and one other field (STORE_ID in this case). The catch, however, is _time must be in epoch (integer) format. It won't work if you format it like it appears in the UI. FTR, the built-in _time field always is in epoch form, but the UI automatically converts it to text when displayed.
--- If this reply helps you, an upvote would be appreciated.