I have search results with a value "creation_time" -- format: 2012-08-22T20:59:51Z
In my search I added:
| eval age = today() - creation_time
I thought maybe clustering with 'kmeans' would do it, so I tried the following:
| kmeans k=4 age |
But this doesn't yield any results.
Suggestions? My output should be column graph with four of them, with the bucket clustering the different ages across the creation_times.
Is this someting similar to what you wanted?
SOMESEARCH | eval age = now() - _time | bucket age bins=4 | chart count by age
I think "bucket" command will do the job.