Hello! i hope you can help me with this.
I´m trying to set as _time an epoch field located at "rt" field.
But if i try to make an timechart after eval _time=getTime, i receive following error.
strftime converts your epoch time to string and that's why it does not work. All you need is this.
index=business AND combo
| eval _time=rt/pow(10,3)
| timechart count
Please up vote and mark as answer if this works for you.
strftime converts your epoch time to string and that's why it does not work. All you need is this.
index=business AND combo
| eval _time=rt/pow(10,3)
| timechart count
Please up vote and mark as answer if this works for you.