Hi there,
I did already several trials with search commands like "eval _time=strptime(time,"%Y-%m-%dT%H:%M:%S")"
but was not able to manage that time chart is using my own timestamp in the message uploaded.
The data has originally same _time as the upload is done by bulk upload of a log file that contains then several events with there own timestamp in the format: time: 2020-11-16T15:15:51.113394
I'd like to show cpu_percentage over my own time stamp.
Hope somebody can help out here
Ralf
yes, time: 2020-11-16T15:15:51.113394. is part of my event
Has time been successfully extracted from your events?
sorry, what do you mean by "extracted" ?
What I can see, please see also the screen dump on my question is, that the time field in the message show a different time than Splunk time.
That I would say can be expected as Splunk recognize the time of uploading
If you expand the event
Do you see time (as well as _time) as a field?
looks like this:
The eval you mentioned should work so long as you do it before the timechart. What do you get if you do the eval and then expand the event as before - does _time = time?
original message looks like this:
after trying with this eval command: - don't know if it is 100% correct
eval _time=strptime(time,"%Y-%m-%d %H:%M:%S.%Q")
it looks like this
It looks like the eval worked - so timechart should now work as it uses _time
unfortunately not:
everything looks empty even when I saw the events are there
Interesting picture. You are doing a timechart using values. If you look at the statistics, you will probably see a multivalue field values(cpu_percentage) against each time bucket (quarter of an hour). This cannot be visualised in this way. What is it you are trying to achieve?