Why is there invalid date in Dashboard Studio search?

[SteveBowser]

I am using the search depicted in the attached photo below to develop a viz in Dashboard Studio separating events by the field "bundleId". It appears to display events in the statistics table the way that I want them to.

However, when I save them to a dashboard via Dashboard Studio, I get an "Invalid Date" where I want the break in events (Note - this does not happen in the "Classic" version)

 

How can the "Invalid date" be removed? I already attempted to eval _time=" " in the appendpipe with no success.

Thank you.

[PickleRick · Accepted solution]

Don't know Dashboard Studio that much but it must be caused by the implicit conversion from numerical timestamp contained in the _time field to a human-readable string. Apparently Dashboard Studio does that differently and that causes the problem.

Let me start by saying that this way of "formatting" table is a bit ugly because it breaks the logical structure of the table. You could try to fiddle with colouring if you want to separate your data visually.

Having said that - the easiest (but still ugly ;-)) way would be to render the _time with strftime and show that field instead of _time.

[SteveBowser]

I changed the search to:

eventtype=forcepoint_messages bundleId=* WEB sender=*
| rex "WEB\-\d*\s(?<Action>\w*\s\w*\s\w*)\."
| rex "src_label\=\'(?<src_label>\S*)\'"
| eval FileName=name, JobName=Name, userName=userName
| fillnull value=" "
| eval Time = strftime(_time, "%Y-%m-%d:%H:%M:%S")
| stats count AS Count BY Time userName JobName FileName Action bundleId
| eval bundleID=bundleId
| appendpipe
[ stats sum(Count) AS Count BY bundleId
| eval userName=""]
| sort - bundleId
| fields - Count bundleId

And got this which will work for now.

As for coloring, I'm attempting to do that based on the field "bundleId" but that has really been an issue, and it's so easy to achieve that in the Classic XML. 

Thank you for the assistance!

V/R

Steve