Is your feature request related to a problem?
Currently, timechart has this restriction on when it is available:
The timechart command requires a timestamp field named @timestamp in the data.
This excludes many potential indexes for which timechart would be useful.
What solution would you like?
An option within timechart to specify the time field to be used instead of @timestamp.
E.g.
timechart [timefield=<timestamp_field>] ...
If this is not feasible, could I get an explanation for why @timestamp is needed for timechart to work properly? I currently don't see any explanation in the rst for why this is the case.
Is your feature request related to a problem?
Currently,
timecharthas this restriction on when it is available:This excludes many potential indexes for which
timechartwould be useful.What solution would you like?
An option within
timechartto specify the time field to be used instead of@timestamp.E.g.
If this is not feasible, could I get an explanation for why
@timestampis needed fortimechartto work properly? I currently don't see any explanation in the rst for why this is the case.