I am trying to re-format the x-axis time to read cleaner. Here is my spl:
index="servers" source="/var/log/secure" action=failure
| timechart count
| eval time=_time
|table time count
| fieldformat time=strftime(time, "%Y%m%d%H%M")
How can I get it in a format like %Y-%m-%d %H:%M ?
↧