I've got a lookupfile with a timestamp (in seconds) and other entries. I've converted the timestamp into a datestring to make it readable (eval Date=strftime(timestamp), "%d.%m.%Y" ) and used a | stats ... by Date command. In a table thats fine, all stats are grouped by the Date.
But when I want to create a Visualization the entries on the X-Axis (the Dates) are not readable. Is there a way to avoid this? Or perhaps it's useful/possible to convert the timestamp to "_time" here and create everything as a timechart?
Thanks in advance for your ideas.
I just tried something out: I used the example above, but used a Unixtimestamp as Date and tried to use this timestamp in a timechart.
... | rename _time AS Eventtime | rename Date as _time | ... | timechart span=1d ... | where _time<=now() AND _time>=strptime("01.10.2013", "%d.%m.%Y")
In my opinion it seems to work. If somebody knows that this kind of transformation causes problems I haven't found out yet, please let me know 😉