hi @to4kawa
Thank You!
when i try first SPL command line
1.| eval Date=coalesce(Date, mvindex(split('Start Time'," "),0)) was work
but 2nd & 3rd doesn't work well.
I try like this first line;
1. index="main"
| eval d=coalesce(Date,mvindex(split('Start Time'," "),0))
| starts count by d
but when I put 2nd & 3rd line it's show us No results found;
1. index="main"
| eval d=coalesce(Date,mvindex(split('Start Time'," "),0))
| eval Date=strptime(d,"%d/%m/%Y")
| fieldformat Date=strftime(Date,"%d/%m/%Y")
| starts count by Date
... View more