Hi,
I've got a lookupfile with a timestamp (in seconds) and other entries. I've converted the timestamp into a datestring to make it readable (eval Date=strftime(timestamp), "%d.%m.%Y" ) and used a | stats ... by Date command. In a table thats fine, all stats are grouped by the Date.
But when I want to create a Visualization the entries on the X-Axis (the Dates) are not readable. Is there a way to avoid this? Or perhaps it's useful/possible to convert the timestamp to "_time" here and create everything as a timechart?
Thanks in advance for your ideas.
Heinz
I just tried something out: I used the example above, but used a Unixtimestamp as Date and tried to use this timestamp in a timechart.
... | rename _time AS Eventtime | rename Date as _time | ... | timechart span=1d ... | where _time<=now() AND _time>=strptime("01.10.2013", "%d.%m.%Y")
In my opinion it seems to work. If somebody knows that this kind of transformation causes problems I haven't found out yet, please let me know 😉
Hi somesoni2,
the table looks like this in the end (unfortunately i don't know how to add a table here...)
Date | A | B | C
27.10.2013 | 100 | 67 | 67
Could you post some sample data from the table your got after your stats command?