I am using timechart to build a graph for the last 7 days. the chart by default uses _time as the format for the Graph. I would like the output to only show timeformat="%A" Day of the week format
Can you help? I have this code
| timechart span=1d sum(mb) by limit=10 hostname usenull=f useother=f
convert _time to day after the timechart, but keep the sort by _time, then remove the column.
* | timechart span=1d count by source | convert timeformat="%d" ctime(_time) AS day | sort _time | fields - _time | table day *
convert _time to day after the timechart, but keep the sort by _time, then remove the column.
* | timechart span=1d count by source | convert timeformat="%d" ctime(_time) AS day | sort _time | fields - _time | table day *