I have a timestamp column, my_time, stored in my kvstore, my_kv. I wanted to generate a report, but I got "No results found."
| inputlookup my_kv | bucket span=1h my_time | timechart count
I wonder if the bin/bucket command works for a lookup or kvstore. If not, are there other solutions? Thanks.
Yes, it does. All bin
does is round down to the nearest specifier; there is no magic. The problem is that timechart
in your case works only on _time
so it is ignoring your my_time
field. You need | rename my_time AS _time
and then it will work.
Yes, it does. All bin
does is round down to the nearest specifier; there is no magic. The problem is that timechart
in your case works only on _time
so it is ignoring your my_time
field. You need | rename my_time AS _time
and then it will work.
Thank you very much!