index=level3 host=Test | table "Opened D" _time
How to get Opened D time value into _time field so that I can use timechart command and use span to get proper visualization.
I tried using below query but no luck.
index=level3 host=Test | eval _time=strptime("Opened D","%m/%d/%Y") |table _time "Opened D
I also have same kind of question, I want to insert data from kv store to index with _time same as fromdate column in my kv store.
I am able to insert data normally i.e without | eval _time = fromdate .
But when I using this eval, clause I am getting error.
For all new data, you should consider indexing Open D as your time field. But for existing field you could use "Open D" like this
index=level3 host=Test | eval OpenD=strptime("Opened D", "%-m/%-d/%Y") | bin OpenD | stats count by OpenD
What is the question here? Are you trying to troubleshoot the error message or do you really just want to eval a field to _time?
The question here is I want _time to be same as Opened D time then only I can use timechart command else timechart command isn't working as expected as it is taking the date the file is uploaded and not Opened D date.
How can I convert Opened D date to _time field.
I see, so something like this maybe?
index=level3 host=Test | eval _time = 'Opened D' | timechart count
Also, if Opened D is in the source data, do you also want to use that as the timestamp of the event when you index the data? That way it will already be the same as _time and you won't have to do any evals.
yes I want to index the filed Openend D of the file so that this filed's time will come in _time but somehow it isn't working don't know why.please help me with this if you can.
But when I tried using the query you provided am getting value in _time=NaN/NaN/aN
NaN:NaN:NaN.000 AM
It isn't getting evaluated properly
index=level3 host=Test | eval _time = 'Opened D'
›
NaN/NaN/aN
NaN:NaN:NaN.000 AM
TASK0157512,4 - Low,Work in Progress,Global - Service Assurance - Tier 2/3,kandukuri.saianusha,Catalog Task,9/27/2016,,9/27/2016,09/27,01/00,2,< 3 Days,0,2,< 3 Days,
host = Test
source = Level3_Daily_Report_26.csv
sourcetype = csv