I am using search
...|timechart sum(x) by y
but _time is showing as 2014-4-3-T 00:00, but I want the format of _time on the x axis to be 2014-4-3 only. How do I do this?
use this
..|timechart sum(x) by y|eval _time=strftime(_time,"%Y"-%m-%d)
use this
..|timechart sum(x) by y|eval _time=strftime(_time,"%Y"-%m-%d)
Thanks its working...