Hi, here's my search, which includes a conversion from epoch time to a Y-d-m time format:
| dbquery "DBNAME" "SELECT useraction FROM usertable" | eval useraction=strftime(useraction,"%Y-%d-%m")
Now I'd like to see how many events occurred for each day