I have code
| eval m=case(minute>0 AND minute<15,15,minute>14 AND minute<30,15,minute>29 AND minute<45,30,minute>44,45) | eval where m = "00" | eval time1=strftime(_time, "%Y-%m-%d %H:00:00") | eval where m = "15" | eval time1=strftime(_time, "%Y-%m-%d %H:15:00") | eval where m = "30" | eval time1=strftime(_time, "%Y-%m-%d %H:30:00") | eval where m = "45" | eval time1=strftime(_time, "%Y-%m-%d %H:45:00") | table system SMF30JBN _time SMF30SRV msused hour m time1
How do I get each where statement just to run the EVAL command that is right under the where statement
Right now ever time ends up with 45 in the minute place
... View more