topic Re: In dashboard studio, how do I change time format? in Splunk Search

How do I change time format in dashboard?

joseph_mbimbi — Wed, 18 Jan 2023 17:11:55 GMT

Hello,
I would like to display dates in a dashboard studio table,
i want the format to be "%Y-%m-%d" but it is not displayed as such.

Here is the spl excerpt:

| eval vuln_publication_date_string = strftime(normalized_publication_time,"%Y-%m-%d")

Here is the result of the search associated with the table. The type of the field is a string

And here the table itself. I guess it is due to the format, but i cannot change it

Does anybody have an idea how to force the format in the table ?
Thank you

Re: In dashboard studio, how do I change time format?

eholz1 — Thu, 01 Dec 2022 18:03:51 GMT

I have the same issue as well. If I ever figure it out I will post. It is a real pain!

Here is on post I found, but the search uses a real string:

| makeresults | eval field1="2017-10-05T16:00:00Z"
| eval new_field=strftime(strptime(field1,"%Y-%m-%dT%H:%M:%SZ")+28800,"%Y-%m-%d %H:%M:%S")
| table new_field

I have yet to figure out how to apply this to something like this:

| eval Date = strftime(_time, "%Y-%m-%d %H:%M:%S")

the eval above works fine in a SimpleXML dashboard but NOT dashboard studio!

eholz1

Re: In dashboard studio, how do I change time format?

eholz1 — Thu, 01 Dec 2022 20:03:53 GMT

Finally figured it out.

1. select the table/fied you want to format

Then get in the edit mode: look for "Column Formatting", select the field you want to format,

and click the tip icon -

Display the field enter formatting:

Success!

eholz1

here:

Re: In dashboard studio, how do I change time format?

sbarnes_nj — Tue, 17 Jan 2023 18:34:37 GMT

I'd like to add one tip to the advice given above: Dashboard Studio will not recognize that a column is a "time" unless it's already in ISO 8601 format or some subset thereof. It's much more strict than Splunk's forwarders and indexers! You need to use strptime()/strftime() to reformat if necessary. Then, according to the not-so-easy-to-find Splunk UI docs you can use MomentJS formatting strings as shown above.

Re: In dashboard studio, how do I change time format?

eholz1 — Wed, 18 Jan 2023 16:18:01 GMT

The links you provided in your "tip" are excellent!!

Thanks!! And it is really easy to format dates in a DB Studio table using the "format column" feature.

Thanks for the tip,

eholz1

Re: In dashboard studio, how do I change time format?

jowenssi — Thu, 20 Jun 2024 18:21:50 GMT

Using YYYY-MM-DD HH:MM:SS will yield incorrect results with the current dashboard studio version due to the overlap of Month and Minute.

The correct way would be to use: YYYY-MM-DD HH:mm:ss

@sbarnes_nj was correct in stating the format reference here: https://momentjs.com/docs/#/displaying/

Re: How do I change time format in dashboard?

Abass42 — Fri, 07 Feb 2025 17:07:05 GMT

I signed in just to say I had this exact problem, and your question was exactly what I was looking for. Thank you. This forum post helped answer my issue.

jowenssi Reply was what I was looking for.

Re: In dashboard studio, how do I change time format?

Abass42 — Fri, 07 Feb 2025 17:09:08 GMT

This is exactly what I was looking for. Really nice doc linked. Thanks