Use field as _time for Timechart and timepicker

[Kieffer87]

I'm trying to chart some phishing logs over time which contain 3 time values:
_time - The time when an analyst processed the phishing request.
email_received - The time the user received the email
time_reported - The time the user reported the email as fishing.

I've put together the following search string to change email_received to _time and chart using timechart. The problem is now timepicker doesn't work as expected because it's still using the original _time from the event and not the email_received value. How can I change _time for both the search and the timechart?

index=phishme sourcetype=phishme:data | eval _time=strptime(email_received,"%b %d %Y %H:%M:%S") | timechart span=1d count as Reports

I've confirmed my eval command is working as expected and email_received is being converted to epoch.

[somesoni2]

The time range picker uses _time field that's available in the base search, no the calculated _time afterwards. The workaround is not very optimal as it has to query either all times or sufficiently large time range where you know logs you want to query exist. Try like this

index=phishme sourcetype=phishme:data earliest=0 | eval _time=strptime(email_received,"%b %d %Y %H:%M:%S")
| where _time>=[| gentimes start=-1 | addinfo | table info_min_time | rename info_min_time as search ] AND _time<[| gentimes start=-1 | addinfo | table info_max_time | rename info_max_time as search]
| timechart span=1d count as Reports

Here we're overriding the timerange of base search to "All times" so all data is selected. The subsearches in where clause will still use the time range picker values and thus allowing filter based on new _time values.

[Kieffer87]

I seem to have spoke too soon. This seems to work fine when the latest event is now (last 7 days), but as soon as you use a latest date in the past (March 5-March10), the count for each day changes drastically.