I have a field in some events that contains a time as a string. The times are in the format "2010-07-15-13", which the fields representing "%Y-%m-%d-%H" (year,month,day,24-hour). I'm trying to convert this string to a time, and I've tried several functions- | eval _time=strptime(hour,"%Y-%m-%d-%H") | convert timeformat="%Y-%m-%d-%H" mktime(hour) as _time However, neither of these functions gives me the correct results. I do get a result- I read that if the provided format string doesn't match the string to parse, you get no result- but the result is wrong, having chopped off the hour portion of the string. Example- 2010-07-08-10 -> 7/8/10 12:00:00.000 AM 2010-07-08-11 -> 7/8/10 12:00:00.000 AM This is not the result I'm looking for as I need the hour data to be in my end result. Does anyone know why these functions are not working as expected? ... View more

I'm trying to restrict the metadata that is available to users of a particular role. The main reason I'm doing this is because I don't want users to be able to see tons of information about different hosts/sources/sourcetypes that they cannot access while they are in the dashboard, but I do want them to be able to see the information about the hosts/sources/sourcetypes that are available to them. Is there a way to restrict the metadata to just what the user is allowed to access? ... View more