Use another time field to group information by time

[bfernandez]

Is there any way to use another time field than timestamp to group information by week?

I tried to create a new time field known for splunk with strptime function and use it to group the information in weeks through bucket and chart commands without success.

Query example:

sourcetype="peticionesh_proceso_negocio" | eval DemoTime = strptime(InitialTime,"%Y-%m-%d %H:%M:%S.%l") | table _time, DemoTime, InitialTime

Data output example:

ID Timestamp (_time) DemoTime InitialTime
1 6/8/12 12:45:00.950 PM 1345413600.000000 2012-08-20 00:00:00.000
2 6/8/12 12:45:00.253 PM 1341180000.000000 2012-07-02 00:00:00.000
3 6/8/12 12:44:59.350 PM 1342994400.000000 2012-07-23 00:00:00.000
4 6/8/12 12:44:58.013 PM 1340575200.000000 2012-06-25 00:00:00.000

Commands used:

... | chart f(x) DemoTime span=1w
… | bucket DemoTime span=1w

Any help to solve this problem is appreciated. Thanks.

[araitz · Accepted solution]

This doesn't work?

sourcetype="peticionesh_proceso_negocio" | eval DemoTime = strptime(InitialTime,"%Y-%m-%d %T.%q) | bin span=7d DemoTime | stats f(x) by DemoTime

[araitz]

I changed it back so you could see the old search. bin and bucket are the same command, the main difference was the use of stats and the split by DemoTime.

[bfernandez]

I swear that yesterday you indicated another solution that include bin command and grouping by week.

sourcetype="peticionesh_proceso_negocio" | eval DemoTime = strptime(InitialTime,"%Y-%m-%d %H:%M:%S.%l") | bin DemoTime span=1w as weeks | chart count by weeks

What is the difference between bucket and bin command? it’s supposed to be an alias for bucket command