topic Re: Stop automatic formatting from HEX to INT in Splunk Dashboard Studio in Dashboards & Visualizations

How to Stop automatic formatting from HEX to INT in Splunk Dashboard Studio?

tudorex5 — Wed, 23 Aug 2023 19:52:46 GMT

Hello,

I am trying to make a table viz in my absolute dashboard studio dashboard. I have a query that has a field called "Failure_Code" that usually presents the hex values (0x18 or 0x12). When developing the query in the search app, the data gets printed in the table statistics as is (in 0x.... format) . That is how I would like it to be printed out in my dashboard.

As soon as I add the query into a table view in a dashboard, it automatically gets converted to int(24, 18...). I am not using any eval, stats or renaming on this field. I tried adding a formatting option on that column, noticed it's automatically set to "number" in the context stanza(formatting function), and modified it to "string" in the JSON source code but it didn't stop the formatting.
I tried the tonumber(myField,"hex") solution but my field was turned to null, and also replacing hex with 16. I tried printf, nothing seems to work.

Thank you for the help!

Re: Stop automatic formatting from HEX to INT in Splunk Dashboard Studio

ITWhisperer — Wed, 23 Aug 2023 11:54:51 GMT

| eval myField=tostring(myField,"hex")

Re: Stop automatic formatting from HEX to INT in Splunk Dashboard Studio

tudorex5 — Wed, 23 Aug 2023 14:43:04 GMT

Thanks for the quick reply.

Unfortunately, using | eval Failure_Code=tostring(Failure_Code,"hex") turns the entire field to null values :

Here it is, working in a normal search query, without the eval (exact same query, opened from the dashboard panel with the "Open in search" option):

And here is the result without the eval, in the dashboard table :

Added SS for clarification, in case my question was all over the place.

Can I use some type of sed/replace or something similar to add quotes to my failure_code or force it into a string value any other way? I'd rather just have it print out clean, like in the normal search, but dashboard studio seems to be doing some behind the scenes formatting that I don;t really get the hang of yet.

Re: Stop automatic formatting from HEX to INT in Splunk Dashboard Studio

ITWhisperer — Wed, 23 Aug 2023 15:19:19 GMT

Which version of Splunk are you using?

Re: Stop automatic formatting from HEX to INT in Splunk Dashboard Studio

tudorex5 — Fri, 25 Aug 2023 06:09:57 GMT

Enterprise 9.0.0.1

Re: Stop automatic formatting from HEX to INT in Splunk Dashboard Studio

ITWhisperer — Fri, 25 Aug 2023 08:46:56 GMT

Please try upgrading to the latest version of Splunk (it works on 9.1.0.2, but not on 8.2.2.1)

Re: Stop automatic formatting from HEX to INT in Splunk Dashboard Studio

tudorex5 — Mon, 28 Aug 2023 07:39:14 GMT

It's going to be a while until it's updated on my end, but I'll mark the answer and reply if it doesn't work, which I hope won't be the case 😅