Alerting

Dashboard

majilan1
Path Finder

I have a search that looks like this: 

index=dog sourcetype=cat earliest=-30d 
[| inputlookup LU1_siem_set_list where f_id=*$pick_f_id$*
| stats values(mc) as search
| eval search="mc=".mvjoin(search," OR mc=")]
| stats latest(_time) by ip.

what i see is :

mc                                             latest(_time)
00.00.01                                  1715477192
00.00.02                                   1715477192                                  
00.00.03                                   1715477192  

how to present this in a dashboard with time formatted.

Thanks!                             

 

0 Karma

majilan1
Path Finder

Thanks, it does help, but when I'm trying to put it in a column chart it does not display anything except the field names _time and ip.

Am I doing something wrong?

Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Verify the IP field does not have any null values because will not show results if a groupby field has null values.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the field is named _time then Splunk will format it automatically.

index=dog sourcetype=cat earliest=-30d 
[| inputlookup LU1_siem_set_list where f_id=*$pick_f_id$*
  | stats values(mc) as search
  | eval search="mc=".mvjoin(search," OR mc=")]
| stats latest(_time) as _time by ip

Otherwise, you can use the convert command to format it.

index=dog sourcetype=cat earliest=-30d 
[| inputlookup LU1_siem_set_list where f_id=*$pick_f_id$*
  | stats values(mc) as search
  | eval search="mc=".mvjoin(search," OR mc=")]
| stats latest(_time) by ip
| convert ctime('latest(_time)')
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...