https://community.splunk.com/t5/Alerting/Dashboard/m-p/687630#M16022 <P>Thanks, it does help, but when I'm trying to put it in a column chart it does not display anything except the field names _time and ip.</P><P>Am I doing something wrong?</P><P>Thanks!</P> Wed, 15 May 2024 14:26:16 GMT majilan1 2024-05-15T14:26:16Z https://community.splunk.com/t5/Alerting/Dashboard/m-p/687555#M16019 <P>I have a search that looks like this:&nbsp;</P><LI-CODE lang="markup">index=dog sourcetype=cat earliest=-30d [| inputlookup LU1_siem_set_list where f_id=*$pick_f_id$* | stats values(mc) as search | eval search="mc=".mvjoin(search," OR mc=")] | stats latest(_time) by ip.</LI-CODE><P>what i see is :</P><LI-CODE lang="markup">mc latest(_time) 00.00.01 1715477192 00.00.02 1715477192 00.00.03 1715477192 </LI-CODE><P>how to present this in a dashboard with time formatted.</P><P>Thanks!&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</P><P>&nbsp;</P> Wed, 15 May 2024 08:51:48 GMT https://community.splunk.com/t5/Alerting/Dashboard/m-p/687555#M16019 majilan1 2024-05-15T08:51:48Z https://community.splunk.com/t5/Alerting/Dashboard/m-p/687556#M16020 <P>If the field is named _time then Splunk will format it automatically.</P><LI-CODE lang="markup">index=dog sourcetype=cat earliest=-30d [| inputlookup LU1_siem_set_list where f_id=*$pick_f_id$* | stats values(mc) as search | eval search="mc=".mvjoin(search," OR mc=")] | stats latest(_time) as _time by ip</LI-CODE><P>Otherwise, you can use the <FONT face="courier new,courier">convert</FONT> command to format it.</P><LI-CODE lang="markup">index=dog sourcetype=cat earliest=-30d [| inputlookup LU1_siem_set_list where f_id=*$pick_f_id$* | stats values(mc) as search | eval search="mc=".mvjoin(search," OR mc=")] | stats latest(_time) by ip | convert ctime('latest(_time)')</LI-CODE> Wed, 15 May 2024 00:11:06 GMT https://community.splunk.com/t5/Alerting/Dashboard/m-p/687556#M16020 richgalloway 2024-05-15T00:11:06Z https://community.splunk.com/t5/Alerting/Dashboard/m-p/687630#M16022 <P>Thanks, it does help, but when I'm trying to put it in a column chart it does not display anything except the field names _time and ip.</P><P>Am I doing something wrong?</P><P>Thanks!</P> Wed, 15 May 2024 14:26:16 GMT https://community.splunk.com/t5/Alerting/Dashboard/m-p/687630#M16022 majilan1 2024-05-15T14:26:16Z https://community.splunk.com/t5/Alerting/Dashboard/m-p/687637#M16023 <P>Verify the IP field does not have any null values because will not show results if a groupby field has null values.</P> Wed, 15 May 2024 15:34:35 GMT https://community.splunk.com/t5/Alerting/Dashboard/m-p/687637#M16023 richgalloway 2024-05-15T15:34:35Z