Why is my search showing 0's?

[Bbyers3]

So I am running a Query using DBConnect. "date_provisioned" is the column that has the time stamp. It is in the format below. I am having issues that when I remove the "timechart span=7d count by platform" section it shows 183 events. I want to count those events based on the time. I feel like I am doing something wrong with the eval _time section.

Please help!

Format:
2018-01-02 00:00:00.0

QUERY:

| dbxquery query="SELECT * FROM \"ESS\".\"dbo\".\"CST_itportal_provisioning\" where Year = Year(GETDATE())" connection="ESS_DB" |eval _time = date_provisioned | timechart span=7d count By platform

[Bbyers3]

Thank you!

I tried that before as well, but I see where I messed up. I had (date_provisioned,"%Y-%m-%d %H:%M:%S.%1N") but I missed the colons 😞 thanks so much for the help. It is working exactly as I want it too.

[cmerriman · Accepted solution]

you need to format your date_provisioned to be in epoch for _time to work in timechart. try this

| dbxquery query="SELECT * FROM \"ESS\".\"dbo\".\"CST_itportal_provisioning\" where Year = Year(GETDATE())" connection="ESS_DB" |eval _time = strptime(date_provisioned,"%Y-%m-%d %H:%M:%S.%1N") | timechart span=7d count By platform

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
https://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Usedefaultfields#Internal_fields