How to use a field other than _time in timecharts

[mmpratt]

I have an issue, and I found a posting here that I thought would fix me up, but there is something wrong and I am not sure what it is. I want to create a stacked barchart showing a date from a datestamp field we have, an error code and the number of devices that get that error code on that day. now if I run my current search just using the | timechart dc(field1), it works just fine, but uses the _time field. My datestamp field is a string, with the format of "2021-07-30". I tried using this code to assign the datestamp field to _ time:

| eval NewTime=strptime(datestamp,"%Y-%m-%d %H:%M:%S")
| eval _time=NewTime | timechart dc(field1) by field2

The search runs, but returns no values. Any suggestions would be helpful.

[ITWhisperer]

If your datestamp field is "2021-07-30" you should only need "%Y-%m-%d" as the format string in your strptime function. If that doesn't work, try append midnight to the string strptime(datestamp." 00:00:00","%Y-%m-%d %H:%M:%S")

[mmpratt]

Thank you for that, I had tried that before and it gave me an error, tried it again and it worked, must've been a typo the first time (facepalm)