Getting Data In

I do not need the seconds field in time but i am unable to separate the time from Date in time chart. Please guide me on this

mehtas
Explorer
eventtype=cppm-pass-authentication (cphost=10.200.22.7 OR cphost=10.200.22.8 OR cphost=10.210.22.8 OR cphost=10.210.22.7 OR cphost=10.218.192.33 OR cphost=10.218.192.34) earliest=-30d@d latest=@d [search eventtype=cppm-guest (cphost=10.200.22.7 OR cphost=10.200.22.8 OR cphost=10.210.22.8 OR cphost=10.210.22.7 OR cphost=10.218.192.33 OR cphost=10.218.192.34)  earliest=-30d@d latest=@d |fields session_id ] | append [| search index=_internal earliest=-30d | head 1000 | fields - * | fields - _* | streamstats count | bucket _time span=1d | eval count=0] | timechart count as mac_count, dc(mac_address) as unique_mac_count span=1d | streamstats avg(mac_count) as avg_mac_count sum(mac_count) as tot_mac_count avg(unique_mac_count) as avg_u_mac_count sum(unique_mac_count) as tot_u_count |eval avg_mac_count=round(avg_mac_count)|eval avg_u_mac_count=round(avg_u_mac_count ) |          table _time, avg_u_mac_count  |     rename tot_mac_count as "Total Guest MACs"| rename tot_u_count as "Total Unique Guest MACs"|    rename avg_mac_count as "Average Guest MACs"| rename mac_count as "Day's Guest MACs"|   rename avg_u_mac_count as "Average Unique Guest MACs"| rename unique_mac_count as "Day's Unique Guest MACs"
Tags (1)
0 Karma

mehtas
Explorer

It is the following output nothing to be interpreted from it:

_time Average Unique Guest MACs
0NaN-NaN-NaN NaN:NaN:NaN 126
0NaN-NaN-NaN NaN:NaN:NaN 132
0NaN-NaN-NaN NaN:NaN:NaN 107
0NaN-NaN-NaN NaN:NaN:NaN 81
0NaN-NaN-NaN NaN:NaN:NaN 66
0NaN-NaN-NaN NaN:NaN:NaN 72
0NaN-NaN-NaN NaN:NaN:NaN 85
0NaN-NaN-NaN NaN:NaN:NaN 89
0NaN-NaN-NaN NaN:NaN:NaN 94
0NaN-NaN-NaN NaN:NaN:N

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try updated answer. _time is a special field and accepts only epoch time value.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Just add following to end of your search

Your search  | fieldformat _time=strftime(_time,"%m/%d/%Y")

Updated answer

Your search | eval Time=strftime(_time,"%m/%d/%Y") | table Time, "Average Unique Guest MACs"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...