I'm looking to create a line chart like the attached picture. The data points would be the time a file is received, there are 5 different files, so it would be a multi-line chart. My most recent attempt was using someone's example of this query. It does work to an extent, but the received time is converted to a decimal which isn't the best for my use case.
| eval t=split(strftime(_time, "%H:%M:%S"), ":") | eval h=mvindex(t,0), m=mvindex(t,1), s=mvindex(t,2) | eval v=(h)+(m/100) | bin _time span=1d | chart max(v) over _time by job
Something like this:
index=_internal
| eval date_hour = strftime(_time, "%H")
| bin _time span=1d
| stats count BY date_hour _time
| sort 0 - count
| timechart span=1d first(date_hour) AS busiest_hour
Try something like this
| eval t=split(strftime(_time, "%H:%M:%S"), ":")
| eval h=mvindex(t,0), m=mvindex(t,1), s=mvindex(t,2)
| eval v=(h)+(m/100)
| eval day=strftime(_time,"%F")
| chart max(v) over day by job