Dashboards & Visualizations

How to convert _time to a human readable format and display Time and Date in a single value panel?

jclehmuth
Path Finder

This sounds easy but I can't seem to figure it out. I'm creating an "Admin" dashboard and a couple of the panels are time last "x" tool ran. The most recent event received from host "x" is what I need to retrieve a time stamp from and post it in a panel.

Currently I have this
host ="10.0.33.210" | chart first(_time)

which outputs : 1418565983

How do I convert that into readable time and date?
I'm attempting to just use a single value panel.

Thanks in advance.

Tags (2)
1 Solution

somesoni2
Revered Legend

Try this

host ="10.0.33.210" | chart first(_time) as Time | convert ctime(Time)

Other options

host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%Y/%m/%d %H:%M:%S")

host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%+")

View solution in original post

somesoni2
Revered Legend

Try this

host ="10.0.33.210" | chart first(_time) as Time | convert ctime(Time)

Other options

host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%Y/%m/%d %H:%M:%S")

host ="10.0.33.210" | chart first(_time) as Time | eval Time=strftime(Time,"%+")

jclehmuth
Path Finder

That worked thanks. I can't believe I couldn't figure that out.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...