How to edit my search to display _time format as the exact time of the event?

[snehasal]

Hi,

I have written a query to find average of the runtime for each job on daily basis. My query works fine and I get results as expected. However, the _time in the search events doesn't show the exact time of event.
e.g _time is step_dtm_pst = 2017-06-05 23:49:24
However, after I run the query _times shows: 05/06/2017 00:00:00.000

The reason for this is using bin _time span=1d in query.

source="Temp10.csv" sourcetype="csv"  
| where step_info ="WORKFLOW START" OR step_info = "WORKFLOW END" 
| eval WfStart=If(step_info="WORKFLOW START",_time,null()) 
| eval WfEnd=If(step_info="WORKFLOW END",_time,null()) 
| sort 0 workflow_run_id 
| streamstats latest(WfStart) as WfStart, earliest(WfEnd) as WfEnd by workflow_run_id 
| eval WfDuration=round(((WfEnd-WfStart)/60),2) 
| bin _time span=1d
| timechart eval(round(avg(WfDuration),2)) as avgWFDuration by workflow_name limit=0 useother=false

I am not sure how to resolve this. Please help.

Thanks,
Sneha

[DalJeanis · Accepted solution]

try this

 source="Temp10.csv" sourcetype="csv"  
 | where step_info ="WORKFLOW START" OR step_info = "WORKFLOW END" 
 | eval WfStart=If(step_info="WORKFLOW START",_time,null()) 
 | eval WfEnd=If(step_info="WORKFLOW END",_time,null()) 
 | sort 0 workflow_run_id 
 | streamstats latest(WfStart) as WfStart, earliest(WfEnd) as WfEnd by workflow_run_id 
 | eval WfDuration=round(((WfEnd-WfStart)/60),2) 
 | timechart span=1d eval(round(avg(WfDuration),2)) as avgWFDuration by workflow_name limit=0 useother=false

[snehasal]

This works.
Thank you:)