Dashboards & Visualizations

How to convert _time to a human readable format and display Time and Date in a single value panel?

jclehmuth
Path Finder

This sounds easy but I can't seem to figure it out. I'm creating an "Admin" dashboard and a couple of the panels are time last "x" tool ran. The most recent event received from host "x" is what I need to retrieve a time stamp from and post it in a panel.

Currently I have this
host ="10.0.33.210" | chart first(_time)

which outputs : 1418565983

How do I convert that into readable time and date?
I'm attempting to just use a single value panel.

Thanks in advance.

Tags (2)
1 Solution

somesoni2
Revered Legend

Try this

host ="10.0.33.210" | chart first(_time) as Time | convert ctime(Time)

Other options

host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%Y/%m/%d %H:%M:%S")

host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%+")

View solution in original post

somesoni2
Revered Legend

Try this

host ="10.0.33.210" | chart first(_time) as Time | convert ctime(Time)

Other options

host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%Y/%m/%d %H:%M:%S")

host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%+")

jclehmuth
Path Finder

That worked thanks. I can't believe I couldn't figure that out.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...