Set Custom time as _time

[kpavan]

Hi All,

I have requirement like we have custom time field ALERTDATETIME i want to display graph where my custom time field should be primary time field. This could have been easy if they asked just display ALERTDATETIME stats but they want time filter in graph where if they select last 7days or expanding to 30 days the data should be displayed based on ALERTDATETIME not the _time field. So am stuck here how to set custom time field as _time when user filtering date.

The date format of ALERTDATETIME is "%Y-%m-%d %H:%M:%S", need to convert only %Y-%m-%d. I tried something like below query but didn't work.

base search
| eval _time=strptime(ALERTDATETIME,"%Y-%m-%d")
| stats count by _time

Thanks!
Pavan

[cmerriman]

try using this:

base search
| addinfo 
| eval _time=strptime(ALERTDATETIME,"%Y-%m-%d") 
| where _time>=info_min_time AND (info_max_time="+Infinity" OR _time<=info_max_time)
| stats count by _time

that should allow for use of the time picker.

[micahkemp]

When the user searches for, say, 7 days, do they expect that search to return results where ALERTDATETIME is within that 7 day window, or do they only want the resulting output to make use of ALERTDATETIME?

[kpavan]

Hi Micahkemp

Thanks for reply!

They want to When the user searches for, say, 7 days, do they expect that search to return results where ALERTDATETIME is within that 7 day window

Thanks!

[micahkemp]

In that case you need to ensure the timepicker range selected encompasses the full time range of the actual _time field that may have events with ALERTDATETIME in the desired range. That may mean users can't select 7 days from the timepicker if they want 7 days based on ALERTDATETIME.

The timepicker will only define your time window based on _time.

[p_gurav]

Hi kpavan,

Please try following link:
link text