Linegraph with Datestring / Convert Timestamp to _time

[HeinzWaescher]

Hi,

I've got a lookupfile with a timestamp (in seconds) and other entries. I've converted the timestamp into a datestring to make it readable (eval Date=strftime(timestamp), "%d.%m.%Y" ) and used a | stats ... by Date command. In a table thats fine, all stats are grouped by the Date.

But when I want to create a Visualization the entries on the X-Axis (the Dates) are not readable. Is there a way to avoid this? Or perhaps it's useful/possible to convert the timestamp to "_time" here and create everything as a timechart?

Thanks in advance for your ideas.

Heinz

[HeinzWaescher]

I just tried something out: I used the example above, but used a Unixtimestamp as Date and tried to use this timestamp in a timechart.

... | rename _time AS Eventtime | rename Date as _time | ... | timechart span=1d ... | where _time<=now() AND _time>=strptime("01.10.2013", "%d.%m.%Y")

In my opinion it seems to work. If somebody knows that this kind of transformation causes problems I haven't found out yet, please let me know 😉

[HeinzWaescher]

Hi somesoni2,

the table looks like this in the end (unfortunately i don't know how to add a table here...)

Date | A | B | C

27.10.2013 | 100 | 67 | 67

[somesoni2]

Could you post some sample data from the table your got after your stats command?