My goal is to present a scatter chart with the size of a file each time a job runs. This requires 3 values: time, size of file, name of job. I have reviewed much of the documentation about time and timecharts and the best representation I have is with time on the y-axis, size of file on the x-axis and the name of job as the legend. the problem is the time value is in epoch and I have been unable to relate a readable time to this chart.
Search saved as a scatter chart
index=main
sourcetype="MFT_byte_size_data"
| table MFT_job_name, MFT_fromFileBytes, timestamp, _time
Saved as a scatter chart
Data csv file
MFT_job_name MFT_fromFileBytes timestamp _time
xxxxxxxx - CAD xxxxxxxx UL Sat only 130 1525558529 2018-05-05T17:15:29.000-0500
xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 370 1525659756 2018-05-06T21:22:36.000-0500
xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 50940 1525486960 2018-05-04T21:22:40.000-0500
xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 35580 1525400533 2018-05-03T21:22:13.000-0500
xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 45060 1525314133 2018-05-02T21:22:13.000-0500
xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 40860 1525227747 2018-05-01T21:22:27.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 4049 1525719615 2018-05-07T14:00:15.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 353 1525633211 2018-05-06T14:00:11.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 15473 1525546814 2018-05-05T14:00:14.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 20737 1525460420 2018-05-04T14:00:20.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 20121 1525374057 2018-05-03T14:00:57.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 22473 1525287653 2018-05-02T14:00:53.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 26897 1525201201 2018-05-01T14:00:01.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 4217 1525114867 2018-04-30T14:01:07.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 72 1525651216 2018-05-06T19:00:16.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 3769 1525478474 2018-05-04T19:01:14.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 3993 1525392038 2018-05-03T19:00:38.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 4441 1525305625 2018-05-02T19:00:25.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 4889 1525219222 2018-05-01T19:00:22.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 5561 1525132818 2018-04-30T19:00:18.000-0500
xxxxxxxx - CAN-xxxxxxxx UL new path on FIS side Sat only 15473 1525558529 2018-05-05T17:15:29.000-0500
xxxxxxxx - US xxxxxxxx UL Sat only 130 1525558529 2018-05-05T17:15:29.000-0500
xxxxxxxx - US xxxxxxxx UL Sun-Fri 10288060 1525659756 2018-05-06T21:22:36.000-0500
xxxxxxxx - US xxxxxxxx UL Sun-Fri 14757070 1525486960 2018-05-04T21:22:40.000-0500
xxxxxxxx - US xxxxxxxx UL Sun-Fri 10684390 1525400533 2018-05-03T21:22:13.000-0500
xxxxxxxx - US xxxxxxxx UL Sun-Fri 10858010 1525314133 2018-05-02T21:22:13.000-0500
xxxxxxxx - US xxxxxxxx UL Sun-Fri 13944050 1525227747 2018-05-01T21:22:27.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 584438 1525719615 2018-05-07T14:00:15.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 72 1525633211 2018-05-06T14:00:11.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 72 1525546814 2018-05-05T14:00:14.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 411325 1525460420 2018-05-04T14:00:20.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 346750 1525374057 2018-05-03T14:00:57.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 348905 1525287653 2018-05-02T14:00:53.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 388810 1525201201 2018-05-01T14:00:01.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 545209 1525114867 2018-04-30T14:01:07.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 72 1525651216 2018-05-06T19:00:16.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 253468 1525478474 2018-05-04T19:01:14.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 234053 1525392038 2018-05-03T19:00:38.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 203982 1525305625 2018-05-02T19:00:25.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 250691 1525219222 2018-05-01T19:00:22.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 188952 1525132818 2018-04-30T19:00:18.000-0500
xxxxxxxx - US-xxxxxxxx UL new path on FIS side Sat only 72 1525558529 2018-05-05T17:15:29.000-0500
Below is a good presentation of how I want the data to look, but the timestamp values mean nothing a human.
... View more