<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Why is there invalid date in Dashboard Studio search? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-there-invalid-date-in-Dashboard-Studio-search/m-p/626241#M51338</link>
    <description>&lt;P&gt;I am using the search depicted in the attached photo below to develop a viz in Dashboard Studio separating events by the field "bundleId". It appears to display events in the statistics table the way that I want them to.&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-01-06 at 2.26.50 PM.png" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/23240iDB2E699E16D8F21F/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screenshot 2023-01-06 at 2.26.50 PM.png" alt="Screenshot 2023-01-06 at 2.26.50 PM.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;However, when I save them to a dashboard via Dashboard Studio, I get an "Invalid Date" where I want the break in events (Note - this does not happen in the "Classic" version)&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-01-06 at 2.32.30 PM.png" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/23241i6FF1E1E0B60063FA/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screenshot 2023-01-06 at 2.32.30 PM.png" alt="Screenshot 2023-01-06 at 2.32.30 PM.png" /&gt;&lt;/span&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;How can the "Invalid date" be removed? I already attempted to eval _time=" " in the appendpipe with no success.&lt;/P&gt;
&lt;P&gt;Thank you.&lt;/P&gt;</description>
    <pubDate>Fri, 06 Jan 2023 22:31:29 GMT</pubDate>
    <dc:creator>SteveBowser</dc:creator>
    <dc:date>2023-01-06T22:31:29Z</dc:date>
    <item>
      <title>Why is there invalid date in Dashboard Studio search?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-there-invalid-date-in-Dashboard-Studio-search/m-p/626241#M51338</link>
      <description>&lt;P&gt;I am using the search depicted in the attached photo below to develop a viz in Dashboard Studio separating events by the field "bundleId". It appears to display events in the statistics table the way that I want them to.&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-01-06 at 2.26.50 PM.png" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/23240iDB2E699E16D8F21F/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screenshot 2023-01-06 at 2.26.50 PM.png" alt="Screenshot 2023-01-06 at 2.26.50 PM.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;However, when I save them to a dashboard via Dashboard Studio, I get an "Invalid Date" where I want the break in events (Note - this does not happen in the "Classic" version)&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-01-06 at 2.32.30 PM.png" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/23241i6FF1E1E0B60063FA/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screenshot 2023-01-06 at 2.32.30 PM.png" alt="Screenshot 2023-01-06 at 2.32.30 PM.png" /&gt;&lt;/span&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;How can the "Invalid date" be removed? I already attempted to eval _time=" " in the appendpipe with no success.&lt;/P&gt;
&lt;P&gt;Thank you.&lt;/P&gt;</description>
      <pubDate>Fri, 06 Jan 2023 22:31:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-there-invalid-date-in-Dashboard-Studio-search/m-p/626241#M51338</guid>
      <dc:creator>SteveBowser</dc:creator>
      <dc:date>2023-01-06T22:31:29Z</dc:date>
    </item>
    <item>
      <title>Re: Invalid date in Dashboard Studio search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-there-invalid-date-in-Dashboard-Studio-search/m-p/626246#M51339</link>
      <description>&lt;P&gt;Don't know Dashboard Studio that much but it must be caused by the implicit conversion from numerical timestamp contained in the _time field to a human-readable string. Apparently Dashboard Studio does that differently and that causes the problem.&lt;/P&gt;&lt;P&gt;Let me start by saying that this way of "formatting" table is a bit ugly because it breaks the logical structure of the table. You could try to fiddle with colouring if you want to separate your data visually.&lt;/P&gt;&lt;P&gt;Having said that - the easiest (but still ugly ;-)) way would be to render the _time with strftime and show that field instead of _time.&lt;/P&gt;</description>
      <pubDate>Fri, 06 Jan 2023 19:57:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-there-invalid-date-in-Dashboard-Studio-search/m-p/626246#M51339</guid>
      <dc:creator>PickleRick</dc:creator>
      <dc:date>2023-01-06T19:57:32Z</dc:date>
    </item>
    <item>
      <title>Re: Invalid date in Dashboard Studio search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-there-invalid-date-in-Dashboard-Studio-search/m-p/626252#M51340</link>
      <description>&lt;P&gt;I changed the search to:&lt;/P&gt;&lt;P&gt;eventtype=forcepoint_messages bundleId=* WEB sender=*&lt;BR /&gt;| rex "WEB\-\d*\s(?&amp;lt;Action&amp;gt;\w*\s\w*\s\w*)\."&lt;BR /&gt;| rex "src_label\=\'(?&amp;lt;src_label&amp;gt;\S*)\'"&lt;BR /&gt;| eval FileName=name, JobName=Name, userName=userName&lt;BR /&gt;| fillnull value=" "&lt;BR /&gt;| eval Time = strftime(_time, "%Y-%m-%d:%H:%M:%S")&lt;BR /&gt;| stats count AS Count BY Time userName JobName FileName Action bundleId&lt;BR /&gt;| eval bundleID=bundleId&lt;BR /&gt;| appendpipe&lt;BR /&gt;[ stats sum(Count) AS Count BY bundleId&lt;BR /&gt;| eval userName=""]&lt;BR /&gt;| sort - bundleId&lt;BR /&gt;| fields - Count bundleId&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;And got this which will work for now.&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-01-06 at 3.10.43 PM.png" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/23244iD4981BABED080BA7/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screenshot 2023-01-06 at 3.10.43 PM.png" alt="Screenshot 2023-01-06 at 3.10.43 PM.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;As for coloring, I'm attempting to do that based on the field "bundleId" but that has really been an issue, and it's so easy to achieve that in the Classic XML.&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thank you for the assistance!&lt;/P&gt;&lt;P&gt;V/R&lt;/P&gt;&lt;P&gt;Steve&lt;/P&gt;</description>
      <pubDate>Fri, 06 Jan 2023 20:15:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-there-invalid-date-in-Dashboard-Studio-search/m-p/626252#M51340</guid>
      <dc:creator>SteveBowser</dc:creator>
      <dc:date>2023-01-06T20:15:23Z</dc:date>
    </item>
  </channel>
</rss>

