How to rename the _time to TIME in the below query:
|inputlookup currentesdorders.csv | dedup ORDER_NUMBER | where ORDER_TOTAL =0 | fields ESD_ORDER CREATION_DATE | eval ESD_ORDER=if(ESD_ORDER="Y","ESD","Physical") | eval _time=CREATION_DATE | timechart span=1w count(CREATION_DATE) as count by ESD_ORDER
try this
...| rename _time AS TIME
oh is see..same question was asked before.you may try this: http://answers.splunk.com/answers/1275/renaming-_time-field-causes-an-unwanted-result
Thanks for the quick answer. Th ecolumn name changes but then the time gets converted to unix format.
Hiw do I retain the date format for example: 2014-03-27