Dashboards & Visualizations

How to change format of single value visualization - Time format?

eholz1
Communicator

I am trying to use Splunk Dashboard Studio,

I have a search for a single value viz:

| makeresults | eval Date=strftime(now(),"%Y-%m-%d %H:%M:%S")
| table Date
| rename Date AS UTC-DateTime

The single value viz always returns the "time" in this format "2022-12-02T20:39:21", ignoring the format

strftime in my search. I can apply a format to a table column no problem.

How can I format the value in the single value viz as "2022-12-02 20:39:21"

and... how can I modify or refresh the query that gets the time every second? I saw a youtube tutorial

on this, but the author did not explain the query or the process to refresh or how to apply a different format to the value.

Please advise,

thanks,

eholz1

Labels (3)
0 Karma

PickleRick
Ultra Champion

Firstly, I'm surprised if your search runs properly. You shouldn't use hyphen in field name.

Secondly, your field name suggests it's in UTC whereas after strftime it will be rendered in user's defined timezone.

Thirdly, ignoring your last rename - "works for me".

Fourthly - don't even think about rerunning this search every second. Yes, I've seen such ideas even on this forum but it's a bad thing. If you want to have a dynamic clock, use client side javascript.

0 Karma

eholz1
Communicator

Hmmm. Thanks -

1. No problem trashing the hypen. Will either delete the field and the viz and look at client side javascript

2. Will eliminate the last rename

Valid suggestions - but still would like to see if there is a way to change the time format for this element from "2022-12-02T20:33:22-08:00" to "2022-12-02 20:33:22"

thanks for the reply,

eholz1

Tags (1)
0 Karma

PickleRick
Ultra Champion

It's kinda hard to believe that your search returns one thing and the visualization does something else.

Does your search return a date string properly? Honestly, I can't see any way for the visualization to _not_ display the provided string.

0 Karma

eholz1
Communicator

Hello Champion,

I suggest you create a dashboard using dashboard studio, add a table and a single value visualization.

Then create a time search for both - using makeresultes and "now(). Check the results.

Thanks,

eholz1

Tags (1)
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...