Alerting

Dashboard time formatting

majilan1
Path Finder

Hi, im working on creating a dashboard but I'm not familiar with time formatting is there a way some one can help on how to format time to strftime in this search to show on the dashboard:

Index=a sourcetype=b earliest=-30d [|inputlookup LU0_siem_asset_list where f_id=*OS-03* | stats values(asset) as search | eval search=mvjoin(search,", OR ")]
| fields src src_ip src_f_id _time
| stats latest(_time) values(*) by src_ip. 

Thanks!

ITWhisperer
SplunkTrust
SplunkTrust

If asset is unique in your lookup, you could do this (the format command will put in the "OR"s between rows)

Index=a sourcetype=b earliest=-30d [|inputlookup LU0_siem_asset_list where f_id=*OS-03* | rename asset as search | table search | format]
| fields src src_ip src_f_id _time
| stats latest(_time) as _time values(*) by src_ip. 
| fieldformat _time=strftime(_time, "%Y-%m-%d %H:%M:%S")

This is just an example of a format you could use

For more details on the option, see the documentation https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Commontimeformatvariables

 

0 Karma

majilan1
Path Finder

The search works, but I'm not able to put a chart even I have 7 statistics the only Splunk visualization I get to work is Histogram chart which is weird. Any idea why? Could it be because I have the exact same _time and values except for values(src) and src_ip are different.

Thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what it is you are trying to visualise - by using values(*) you will get a series of multivalue fields - how are you trying to visualise these?

0 Karma

majilan1
Path Finder

to be clear here is what i'm getting:

src_ip                     _time                               values(src)                      values(src_f_id)                                                                        01.00.00                 2024-04-10                  abcd1                                  OS-0030

02.00.00                  2024-04-10                  abcd2                                  OS-0030

03.00.00                   2024-04-10                 abcd3                                    OS-0030

So this is what I see on my end, what I'm trying to do is to present these in a nice dashboard.

Thanks! 

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...