Trouble converting time (epoch) when using timechart

[dpoon]

I can't seem to convert epoch time when using timechart. I'm trying to get each users first logon of the day over a period of time. Here's my search:

sourcetype="wineventlog:security" NOT Account_Name="*$" EventCode=4624 | timechart span=1d min(_time) as FirstLogon by user | convert ctime(FirstLogon)

I could use a fresh set of eyes on this. Any help would be appreciated!

[somesoni2 · Accepted solution]

Try this

 sourcetype="wineventlog:security" NOT Account_Name="*$" EventCode=4624| eval FirstLogon=strftime(_time, "%m/%d/%y %H:%M:%S")| timechart span=5m last(FirstLogon) as FirstLogon by user 

[somesoni2]

My bad, I overlooked it. Will update the answer.

[dpoon]

Thank you. Got it working, but had to use 'last(FirstLogon)' instead of 'first(FirstLogon)' since first was pulling the latest logon of the day.

[dpoon]

I'm using 6.0

[linu1988]

which version of splunk are you using?