This search is ok
... | stats max(fieldname1) as fn1 by _time
but I want to control the format of the _time field to be format to be YYYY-MM-DD
How can I do this?
I know i can do
... | timechart span=d max(fieldname1) as fn1 but i am looking for another way as it relates to something I am working on and the timechart option won't work.
I am think something like
... | eval time_field=(_time,"YYYY-MM-DD")| stats max(fieldname1) as fn1 by time_field
Can this be done?