Dashboards & Visualizations

How to change format of single value visualization - Time format?

eholz1
Contributor

I am trying to use Splunk Dashboard Studio,

I have a search for a single value viz:

| makeresults | eval Date=strftime(now(),"%Y-%m-%d %H:%M:%S")
| table Date
| rename Date AS UTC-DateTime

The single value viz always returns the "time" in this format "2022-12-02T20:39:21", ignoring the format

strftime in my search. I can apply a format to a table column no problem.

How can I format the value in the single value viz as "2022-12-02 20:39:21"

and... how can I modify or refresh the query that gets the time every second? I saw a youtube tutorial

on this, but the author did not explain the query or the process to refresh or how to apply a different format to the value.

Please advise,

thanks,

eholz1

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Firstly, I'm surprised if your search runs properly. You shouldn't use hyphen in field name.

Secondly, your field name suggests it's in UTC whereas after strftime it will be rendered in user's defined timezone.

Thirdly, ignoring your last rename - "works for me".

Fourthly - don't even think about rerunning this search every second. Yes, I've seen such ideas even on this forum but it's a bad thing. If you want to have a dynamic clock, use client side javascript.

0 Karma

eholz1
Contributor

Hmmm. Thanks -

1. No problem trashing the hypen. Will either delete the field and the viz and look at client side javascript

2. Will eliminate the last rename

Valid suggestions - but still would like to see if there is a way to change the time format for this element from "2022-12-02T20:33:22-08:00" to "2022-12-02 20:33:22"

thanks for the reply,

eholz1

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's kinda hard to believe that your search returns one thing and the visualization does something else.

Does your search return a date string properly? Honestly, I can't see any way for the visualization to _not_ display the provided string.

0 Karma

eholz1
Contributor

Hello Champion,

I suggest you create a dashboard using dashboard studio, add a table and a single value visualization.

Then create a time search for both - using makeresultes and "now(). Check the results.

Thanks,

eholz1

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...