topic Dashboard time formatting in Alerting

Dashboard time formatting

majilan1 — Tue, 14 May 2024 22:07:31 GMT

Hi, im working on creating a dashboard but I'm not familiar with time formatting is there a way some one can help on how to format time to strftime in this search to show on the dashboard:

Thanks!

Re: Dashboard time formatting

ITWhisperer — Tue, 14 May 2024 22:33:37 GMT

If asset is unique in your lookup, you could do this (the format command will put in the "OR"s between rows)

This is just an example of a format you could use

For more details on the option, see the documentation https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Commontimeformatvariables

Re: Dashboard time formatting

majilan1 — Tue, 14 May 2024 23:25:43 GMT

The search works, but I'm not able to put a chart even I have 7 statistics the only Splunk visualization I get to work is Histogram chart which is weird. Any idea why? Could it be because I have the exact same _time and values except for values(src) and src_ip are different.

Thanks!

Re: Dashboard time formatting

ITWhisperer — Tue, 14 May 2024 23:32:34 GMT

It is not clear what it is you are trying to visualise - by using values(*) you will get a series of multivalue fields - how are you trying to visualise these?

Re: Dashboard time formatting

majilan1 — Tue, 14 May 2024 23:45:21 GMT

to be clear here is what i'm getting:

src_ip _time values(src) values(src_f_id) 01.00.00 2024-04-10 abcd1 OS-0030

02.00.00 2024-04-10 abcd2 OS-0030

03.00.00 2024-04-10 abcd3 OS-0030

So this is what I see on my end, what I'm trying to do is to present these in a nice dashboard.

Thanks!