Dashboards & Visualizations

Stats Auto Bin Time

MrJohn230
Path Finder

I have created a dashboard in dashboard studio. I have a table visualization, see my code below. 

So, the "Time" column auto sets my | bin to one minute. When I update my timepicker to say the last 7 days it still shows the time |bin as one minute. 

How can I dynamically change the |bin to best fit my timepicker selection?

 

| search cat IN ($t_endpoint$) AND Car IN ($t_car$)
| eval Time=strftime(_time,"%Y-%m-%d-%I:%M %p")
| stats limit=15 sum(Numbercat) as Numbercat, avg(catTime) as AvgcatSecs by Time, Car, cat

 

 

Labels (3)
0 Karma
1 Solution

MrJohn230
Path Finder

This is what worked for me. I added a TimeBucket dropdown box and created a token. 

| search cat IN ($t_endpoint$) AND Car IN ($t_car$)
|bin _time span=$t_bin$
| stats limit=15 sum(Numbercat) as Numbercat, avg(catTime) as AvgcatSecs by _time, Car, cat
| eval Time=strftime(_time,"%Y-%m-%d-%I:%M %p")
|fields - _time
|fields Time, Numbercat





View solution in original post

0 Karma

MrJohn230
Path Finder

This is what worked for me. I added a TimeBucket dropdown box and created a token. 

| search cat IN ($t_endpoint$) AND Car IN ($t_car$)
|bin _time span=$t_bin$
| stats limit=15 sum(Numbercat) as Numbercat, avg(catTime) as AvgcatSecs by _time, Car, cat
| eval Time=strftime(_time,"%Y-%m-%d-%I:%M %p")
|fields - _time
|fields Time, Numbercat





0 Karma

PickleRick
SplunkTrust
SplunkTrust

Converting the time to a string is a peculiar way to do binning. I'd rather simply use the bin command with a proper set of parameters for binning.

If you want to display your time in a human-readable form you can still do fieldformat.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...