Can you create a single value visualisation where the value is a field value?

[ebs]

Hi,

I have a use case where I would like to use the single value visualisation to display the time a service starts and another one displaying when the service ends. Is this possible? I'd prefer to achieve this with SPL

[gcusello]

Hi @ebs,

you have to create a search (using only SPL) that has as output the starting time e.g.:

index=my_index
| stats earliest(_time) AS earliest
| table earliest

the only attention is that you have to display only one field (the starting time).

Ciao.

Giuseppe

[ebs]

Hi @gcusello ,

Thanks, this helps a lot. Only thing now is that its displaying like 1622674823. How can I convert this to a datetime?

[gcusello · Accepted solution]

Hi @ebs,

see eval command and strftime option:

| eval earliest=strftime(earliest,"%d/%m/%Y %H:%M:%S")

for more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Eval and https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/DateandTimeFunctions#strftime.28X...

Ciao.

Giuseppe

[gcusello]

Hi @ebs,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉