Dashboards & Visualizations

Why is the timestamp format displayed on the dashboard different from the exported PDF output?

billycote
Path Finder

I have a dashboard that I am exporting out to a PDF on a schedule. The search works fine, the dashboard looks fine, the e-mail works fine, but I have one small problem. On the dashboard I see this

2015-09-30 09:30:00     wednesday   cg1-r-fid-oma-l2    7602398 

On the PDF export I see this:

2015-09-30T09:30:00-0400 wednesday cg1-r-fid-oma-l2 7602398

I can understand what the PDF means. I just don't want to see the -0400 (timezone offset I believe) It would be much more clear if it looked just like it did on the dashboard. Is there a format somewhere that I'm missing?

0 Karma
1 Solution

billycote
Path Finder

looks like it was answered in another post.

It looks like Splunk is smart about _time and shows it the way that the user would want but on the export it adds formatting characters. I imagine it would be so that someone could programatically calculate time, etc. But the answer I found and it worked was to change the format in the dashboard firt:

| eval mytime = strftime(_time, "%Y-%m-%d %H:%M:%S")

View solution in original post

0 Karma

billycote
Path Finder

looks like it was answered in another post.

It looks like Splunk is smart about _time and shows it the way that the user would want but on the export it adds formatting characters. I imagine it would be so that someone could programatically calculate time, etc. But the answer I found and it worked was to change the format in the dashboard firt:

| eval mytime = strftime(_time, "%Y-%m-%d %H:%M:%S")

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...