Hi
I want to show the Logon time and logoff time and duration in calendar customization in human readable format but its not working when I convert epoch time in to readable format.
search i'm using:
index=cisco_wsa user=abcdk| eval time=_time | timechart span=1d min(time) as "LogonTime", max(time) as "LogoffTime"|eval Duration=(LogoffTime - LogonTime)/3600 |convert timeformat="%m/%d/%y %H:%M:%S" ctime(*)
The calendar custom visualization is expecting numerical data for the values which is similar to a line chart. Basically, if it works on a line chart, it should work on the calendar as well.
Have you tried using fieldformat
?
index=cisco_wsa user=acdkn002 | eval time=_time | timechart span=1d min(time) as "LogonTime", max(time) as "LogoffTime"|eval Duration=(LogoffTime - LogonTime)/3600 |fieldformat LogonTime=strftime(LogonTime,"%m/%d/%y %H:%M:%S") |fieldformat LogoffTime =strftime(LogoffTime ,"%m/%d/%y %H:%M:%S")
I tried, its not working.