eventtype=cppm-pass-authentication (cphost=10.200.22.7 OR cphost=10.200.22.8 OR cphost=10.210.22.8 OR cphost=10.210.22.7 OR cphost=10.218.192.33 OR cphost=10.218.192.34) earliest=-30d@d latest=@d [search eventtype=cppm-guest (cphost=10.200.22.7 OR cphost=10.200.22.8 OR cphost=10.210.22.8 OR cphost=10.210.22.7 OR cphost=10.218.192.33 OR cphost=10.218.192.34) earliest=-30d@d latest=@d |fields session_id ] | append [| search index=_internal earliest=-30d | head 1000 | fields - * | fields - _* | streamstats count | bucket _time span=1d | eval count=0] | timechart count as mac_count, dc(mac_address) as unique_mac_count span=1d | streamstats avg(mac_count) as avg_mac_count sum(mac_count) as tot_mac_count avg(unique_mac_count) as avg_u_mac_count sum(unique_mac_count) as tot_u_count |eval avg_mac_count=round(avg_mac_count)|eval avg_u_mac_count=round(avg_u_mac_count ) | table _time, avg_u_mac_count | rename tot_mac_count as "Total Guest MACs"| rename tot_u_count as "Total Unique Guest MACs"| rename avg_mac_count as "Average Guest MACs"| rename mac_count as "Day's Guest MACs"| rename avg_u_mac_count as "Average Unique Guest MACs"| rename unique_mac_count as "Day's Unique Guest MACs"
It is the following output nothing to be interpreted from it:
_time Average Unique Guest MACs
0NaN-NaN-NaN NaN:NaN:NaN 126
0NaN-NaN-NaN NaN:NaN:NaN 132
0NaN-NaN-NaN NaN:NaN:NaN 107
0NaN-NaN-NaN NaN:NaN:NaN 81
0NaN-NaN-NaN NaN:NaN:NaN 66
0NaN-NaN-NaN NaN:NaN:NaN 72
0NaN-NaN-NaN NaN:NaN:NaN 85
0NaN-NaN-NaN NaN:NaN:NaN 89
0NaN-NaN-NaN NaN:NaN:NaN 94
0NaN-NaN-NaN NaN:NaN:N
Try updated answer. _time is a special field and accepts only epoch time value.
Just add following to end of your search
Your search | fieldformat _time=strftime(_time,"%m/%d/%Y")
Your search | eval Time=strftime(_time,"%m/%d/%Y") | table Time, "Average Unique Guest MACs"