How to change format of single value visualization - Time format?

[eholz1]

I am trying to use Splunk Dashboard Studio,

I have a search for a single value viz:

| makeresults | eval Date=strftime(now(),"%Y-%m-%d %H:%M:%S")
| table Date
| rename Date AS UTC-DateTime

The single value viz always returns the "time" in this format "2022-12-02T20:39:21", ignoring the format

strftime in my search. I can apply a format to a table column no problem.

How can I format the value in the single value viz as "2022-12-02 20:39:21"

and... how can I modify or refresh the query that gets the time every second? I saw a youtube tutorial

on this, but the author did not explain the query or the process to refresh or how to apply a different format to the value.

Please advise,

thanks,

eholz1

[PickleRick]

Firstly, I'm surprised if your search runs properly. You shouldn't use hyphen in field name.

Secondly, your field name suggests it's in UTC whereas after strftime it will be rendered in user's defined timezone.

Thirdly, ignoring your last rename - "works for me".

Fourthly - don't even think about rerunning this search every second. Yes, I've seen such ideas even on this forum but it's a bad thing. If you want to have a dynamic clock, use client side javascript.

[eholz1]

Hmmm. Thanks -

1. No problem trashing the hypen. Will either delete the field and the viz and look at client side javascript

2. Will eliminate the last rename

Valid suggestions - but still would like to see if there is a way to change the time format for this element from "2022-12-02T20:33:22-08:00" to "2022-12-02 20:33:22"

thanks for the reply,

eholz1

[PickleRick]

It's kinda hard to believe that your search returns one thing and the visualization does something else.

Does your search return a date string properly? Honestly, I can't see any way for the visualization to _not_ display the provided string.

[eholz1]

Hello Champion,

I suggest you create a dashboard using dashboard studio, add a table and a single value visualization.

Then create a time search for both - using makeresultes and "now(). Check the results.

Thanks,

eholz1