Splunk Search

create timechart using a string date field

jdepp
Path Finder

I found a few answers here on this forum on how to use a date string field as the datetime for a timechart. I tried these but could not get it to work.
I want to view counts for the last 7 days based on that date. The datetime field format is the following;

created_date
2016-08-18T13:45:08.000Z

This is the original timechart format

source="/data.newIndex/tcp/10064" timechart count AS Count

but I changed to the one this and still not getting any results I expected.

source="/data.newIndex/tcp/10064"  eval e_field = strptime(created_date, "%Y-%M-dThh:hh:ss.000Z") | eval _time = e_field | timechart count AS Count

Please any advice or assistance appreciated.

Thanks

Tags (3)
0 Karma
1 Solution

sundareshr
Legend

Try this

source="/data.newIndex/tcp/10064" | eval e_field = strptime(created_date, "%Y-%m-%dT%H:%M:%S.%3NZ") | eval _time=e_field | timechart count AS Count

*OR*

source="/data.newIndex/tcp/10064" | eval e_field = strptime(created_date, "%Y-%m-%dT%H:%M:%S.%3NZ") | bin e_field | stats count AS Count by e_field

View solution in original post

sundareshr
Legend

Try this

source="/data.newIndex/tcp/10064" | eval e_field = strptime(created_date, "%Y-%m-%dT%H:%M:%S.%3NZ") | eval _time=e_field | timechart count AS Count

*OR*

source="/data.newIndex/tcp/10064" | eval e_field = strptime(created_date, "%Y-%m-%dT%H:%M:%S.%3NZ") | bin e_field | stats count AS Count by e_field

jdepp
Path Finder

the first one worked. Thanks very much. Appreciate it.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...