formatting _time field into a YYYY-MM-DD field

[HattrickNZ]

This search is ok
... | stats max(fieldname1) as fn1 by _time

but I want to control the format of the _time field to be format to be YYYY-MM-DD

How can I do this?

I know i can do ... | timechart span=d max(fieldname1) as fn1 but i am looking for another way as it relates to something I am working on and the timechart option won't work.

I am think something like

... | eval time_field=(_time,"YYYY-MM-DD")| stats max(fieldname1) as fn1 by time_field

Can this be done?

[jtrucks]

Use convert:

... | convert timeformat="%Y-%m-%d" ctime(_time) AS ctime | ...

You can use whatever ... AS yourfield you want, of course.

[stephane_cyrill]

try this:
... | eval time_field=strptime
(_time,"%Y-%m-%d")|
stats max(fieldname1)
as fn1 by time_field

[HattrickNZ]

think this is what I want
http://answers.splunk.com/answers/94614/how-to-extract-date-yyyymmdd-from-time.html