Why is timchart not working on lookup csv data?

[venky1544]

Hi All

i ahve a lookup file .csv where i have timestamp Name and USEDGB values  i have been trying to run a time chart to see the total USEDGB per day Both lookup definition and lookup table file has app permissions 

|inputlookup ABC_DISK_UTILIZATION.csv |eval  _time=Timestamp |timechart span=24h sum(USEDGB)  

the result only shows time but no values of USEDGB can you please help 

Timestamp	NAME	USEDGB
12/08/2023 22:04	RECO_A	48.61
12/08/2023 13:04	RECO_B	46.21
12/08/2023 03:04	RECO_C	46133.89
11/08/2023 20:01	RECO_A	164.11
11/08/2023 18:01	RECO_B	48.61
11/08/2023 16:01	RECO_C	46.21
10/08/2023 22:00	RECO_A	45327.22
10/08/2023 17:00	RECO_B	193.4
10/08/2023 08:00	RECO_C	48.61
09/08/2023 21:00	RECO_A	46.21
09/08/2023 13:00	RECO_B	45205.72
09/08/2023 06:00	RECO_C	132.57
08/08/2023 19:00	RECO_A	48.61
08/08/2023 12:00	RECO_B	46.21
08/08/2023 10:00	RECO_C	45203.77
07/08/2023 22:00	RECO_A	132.56
07/08/2023 14:00	RECO_B	48.61
07/08/2023 07:00	RECO_C	46.21
06/08/2023 22:04	RECO_A	45199.08
06/08/2023 13:04	RECO_B	123.85
06/08/2023 03:04	RECO_C	48.61
05/08/2023 20:01	RECO_A	46.21
05/08/2023 18:01	RECO_B	45196.12
05/08/2023 16:01	RECO_C	117.4

[richgalloway]

The timestamp commands requires the _time field, which must be in epoch form.  Convert Timestamp into _time using strptime().

|inputlookup ABC_DISK_UTILIZATION.csv 
|eval _time=strptime(Timestamp, "%d/%m/%Y %H:%M") 
|timechart span=24h sum(USEDGB) 

[venky1544]

Hi @richgalloway 

did tried that not working 😞

[ITWhisperer]

There doesn't appear to be anything wrong with your search - perhaps it is your data. Please share some actual rows from your csv.