Splunk Search

create timechart using a string date field

Path Finder

I found a few answers here on this forum on how to use a date string field as the datetime for a timechart. I tried these but could not get it to work.
I want to view counts for the last 7 days based on that date. The datetime field format is the following;

created_date
2016-08-18T13:45:08.000Z

This is the original timechart format

source="/data.newIndex/tcp/10064" timechart count AS Count

but I changed to the one this and still not getting any results I expected.

source="/data.newIndex/tcp/10064"  eval e_field = strptime(created_date, "%Y-%M-dThh:hh:ss.000Z") | eval _time = e_field | timechart count AS Count

Please any advice or assistance appreciated.

Thanks

Tags (3)
0 Karma
1 Solution

Legend

Try this

source="/data.newIndex/tcp/10064" | eval e_field = strptime(created_date, "%Y-%m-%dT%H:%M:%S.%3NZ") | eval _time=e_field | timechart count AS Count

*OR*

source="/data.newIndex/tcp/10064" | eval e_field = strptime(created_date, "%Y-%m-%dT%H:%M:%S.%3NZ") | bin e_field | stats count AS Count by e_field

View solution in original post

Legend

Try this

source="/data.newIndex/tcp/10064" | eval e_field = strptime(created_date, "%Y-%m-%dT%H:%M:%S.%3NZ") | eval _time=e_field | timechart count AS Count

*OR*

source="/data.newIndex/tcp/10064" | eval e_field = strptime(created_date, "%Y-%m-%dT%H:%M:%S.%3NZ") | bin e_field | stats count AS Count by e_field

View solution in original post

Path Finder

the first one worked. Thanks very much. Appreciate it.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!