Getting Data In

I do not need the seconds field in time but i am unable to separate the time from Date in time chart. Please guide me on this

mehtas
Explorer
eventtype=cppm-pass-authentication (cphost=10.200.22.7 OR cphost=10.200.22.8 OR cphost=10.210.22.8 OR cphost=10.210.22.7 OR cphost=10.218.192.33 OR cphost=10.218.192.34) earliest=-30d@d latest=@d [search eventtype=cppm-guest (cphost=10.200.22.7 OR cphost=10.200.22.8 OR cphost=10.210.22.8 OR cphost=10.210.22.7 OR cphost=10.218.192.33 OR cphost=10.218.192.34)  earliest=-30d@d latest=@d |fields session_id ] | append [| search index=_internal earliest=-30d | head 1000 | fields - * | fields - _* | streamstats count | bucket _time span=1d | eval count=0] | timechart count as mac_count, dc(mac_address) as unique_mac_count span=1d | streamstats avg(mac_count) as avg_mac_count sum(mac_count) as tot_mac_count avg(unique_mac_count) as avg_u_mac_count sum(unique_mac_count) as tot_u_count |eval avg_mac_count=round(avg_mac_count)|eval avg_u_mac_count=round(avg_u_mac_count ) |          table _time, avg_u_mac_count  |     rename tot_mac_count as "Total Guest MACs"| rename tot_u_count as "Total Unique Guest MACs"|    rename avg_mac_count as "Average Guest MACs"| rename mac_count as "Day's Guest MACs"|   rename avg_u_mac_count as "Average Unique Guest MACs"| rename unique_mac_count as "Day's Unique Guest MACs"
Tags (1)
0 Karma

mehtas
Explorer

It is the following output nothing to be interpreted from it:

_time Average Unique Guest MACs
0NaN-NaN-NaN NaN:NaN:NaN 126
0NaN-NaN-NaN NaN:NaN:NaN 132
0NaN-NaN-NaN NaN:NaN:NaN 107
0NaN-NaN-NaN NaN:NaN:NaN 81
0NaN-NaN-NaN NaN:NaN:NaN 66
0NaN-NaN-NaN NaN:NaN:NaN 72
0NaN-NaN-NaN NaN:NaN:NaN 85
0NaN-NaN-NaN NaN:NaN:NaN 89
0NaN-NaN-NaN NaN:NaN:NaN 94
0NaN-NaN-NaN NaN:NaN:N

0 Karma

somesoni2
Revered Legend

Try updated answer. _time is a special field and accepts only epoch time value.

0 Karma

somesoni2
Revered Legend

Just add following to end of your search

Your search  | fieldformat _time=strftime(_time,"%m/%d/%Y")

Updated answer

Your search | eval Time=strftime(_time,"%m/%d/%Y") | table Time, "Average Unique Guest MACs"
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...