Hello.
Now, I must get a time curve using a field value .
My data has these fields:_time,CreateDate
There is a data : 2018-09-18 20:30:04 , CreateDate="2018-09-18 01:04:19.95", EndDate="2018-09-18 09:16:47.813"
"2018-09-18 20:30:04 " is _time,
"2018-09-18 01:04:19.95" is CreateDate,
I want to get a time curve using the CreateDate field.
What should I do ?
Hi WXY,
if you want to span events every hour, try something like this:
your_search
| eval CreateDate=strptime(CreateDate,"%Y-%m-%d %H:%M:%S.%N")
| bin span=1h CreateDate
| stats count BY CreateDate
| eval CreateDate=strftime(CreateDate,"%Y-%m-%d %H:%M:%S.%N")
Bye.
Giuseppe
@WXY,
Try
"your search" |eval _time=strptime(CreateDate,"%Y-%m-%d %H:%M:%S.%N") |timechart "field you want to chart"