I am trying to use Splunk Dashboard Studio,
I have a search for a single value viz:
| makeresults | eval Date=strftime(now(),"%Y-%m-%d %H:%M:%S") | table Date | rename Date AS UTC-DateTime
The single value viz always returns the "time" in this format "2022-12-02T20:39:21", ignoring the format
strftime in my search. I can apply a format to a table column no problem.
How can I format the value in the single value viz as "2022-12-02 20:39:21"
and... how can I modify or refresh the query that gets the time every second? I saw a youtube tutorial
on this, but the author did not explain the query or the process to refresh or how to apply a different format to the value.
Firstly, I'm surprised if your search runs properly. You shouldn't use hyphen in field name.
Secondly, your field name suggests it's in UTC whereas after strftime it will be rendered in user's defined timezone.
Thirdly, ignoring your last rename - "works for me".
Hmmm. Thanks -
2. Will eliminate the last rename
Valid suggestions - but still would like to see if there is a way to change the time format for this element from "2022-12-02T20:33:22-08:00" to "2022-12-02 20:33:22"
thanks for the reply,
It's kinda hard to believe that your search returns one thing and the visualization does something else.
Does your search return a date string properly? Honestly, I can't see any way for the visualization to _not_ display the provided string.
I suggest you create a dashboard using dashboard studio, add a table and a single value visualization.
Then create a time search for both - using makeresultes and "now(). Check the results.