topic Re: Can you create a single value visualisation where the value is a field value? in Dashboards & Visualizations

Can you create a single value visualisation where the value is a field value?

ebs — Thu, 03 Jun 2021 06:00:58 GMT

Hi,

I have a use case where I would like to use the single value visualisation to display the time a service starts and another one displaying when the service ends. Is this possible? I'd prefer to achieve this with SPL

Re: Can you create a single value visualisation where the value is a field value?

gcusello — Thu, 03 Jun 2021 06:36:43 GMT

Hi @ebs,

you have to create a search (using only SPL) that has as output the starting time e.g.:

index=my_index | stats earliest(_time) AS earliest | table earliest

the only attention is that you have to display only one field (the starting time).

Ciao.

Giuseppe

Re: Can you create a single value visualisation where the value is a field value?

ebs — Thu, 03 Jun 2021 06:46:39 GMT

Hi @gcusello ,

Thanks, this helps a lot. Only thing now is that its displaying like 1622674823. How can I convert this to a datetime?

Re: Can you create a single value visualisation where the value is a field value?

gcusello — Thu, 03 Jun 2021 06:53:01 GMT

Hi @ebs,

see eval command and strftime option:

| eval earliest=strftime(earliest,"%d/%m/%Y %H:%M:%S")

for more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Eval and https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/DateandTimeFunctions#strftime.28X.2CY.29

Ciao.

Giuseppe

Re: Can you create a single value visualisation where the value is a field value?

gcusello — Mon, 07 Jun 2021 06:39:16 GMT

Hi @ebs,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉