how to use a field as timestamp with epoch time for a timechart

[Ralf]

Hi there,

I did already several trials with search commands like "eval _time=strptime(time,"%Y-%m-%dT%H:%M:%S")"
but was not able to manage that time chart is using my own timestamp in the message uploaded.

The data has originally same _time as the upload is done by bulk upload of a log file that contains then several events with there own timestamp in the format:  time: 2020-11-16T15:15:51.113394 

I'd like to show cpu_percentage over my own time stamp.

Hope somebody can help out here

Ralf

[Ralf]

yes,    time: 2020-11-16T15:15:51.113394.   is part of my event

[ITWhisperer]

Has time been successfully extracted from your events?

[Ralf]

sorry, what do you mean by "extracted" ?

What I can see, please see also the screen dump on my question is, that the time field in the message show a different time than Splunk time.

That I would say can be expected as Splunk recognize the time of uploading

[ITWhisperer]

If you expand the event

Do you see time (as well as _time) as a field?

[Ralf]

looks like this:

[ITWhisperer]

The eval you mentioned should work so long as you do it before the timechart. What do you get if you do the eval and then expand the event as before - does _time = time?

[Ralf]

original message looks like this:

after trying with this eval command: - don't know if it is 100% correct

eval _time=strptime(time,"%Y-%m-%d %H:%M:%S.%Q")

it looks like this

 

[ITWhisperer]

It looks like the eval worked - so timechart should now work as it uses _time

[Ralf]

unfortunately not:

everything looks empty even when I saw the events are there

[ITWhisperer]

Interesting picture.  You are doing a timechart using values. If you look at the statistics, you will probably see a multivalue field values(cpu_percentage) against each time bucket (quarter of an hour). This cannot be visualised in this way. What is it you are trying to achieve?