in my query i have a parsed timestamp which is the actual event time of this record.
it is specific to the application but not a _recieveTime or _messageTime that is specific to log
i want to timeslice by that parsed timestamp field.
the command timeslice cannot pass a field.
so how i can do it?
Please sign in to leave a comment.