How to extract date YYYYMMDD from _time?
... | eval mytime=strftime(_time, "%Y%m%d") | table mytime
View solution in original post
How do i get this treated as date again?
I was using the above eval to get just the date out (ignoring the time) ... but i see that the string extracted is treated as a number when i graph it.
How do i get it converted back to date?
eg: i have events with different timestamp and the same date. I want to group them based on the date by ignoring the timestamp on it.
...| eval my_new_time = strptime(mytime, "%Y%m%d")