Dashboards & Visualizations

Why is there invalid date in Dashboard Studio search?

SteveBowser
Explorer

I am using the search depicted in the attached photo below to develop a viz in Dashboard Studio separating events by the field "bundleId". It appears to display events in the statistics table the way that I want them to.

Screenshot 2023-01-06 at 2.26.50 PM.png

However, when I save them to a dashboard via Dashboard Studio, I get an "Invalid Date" where I want the break in events (Note - this does not happen in the "Classic" version)

Screenshot 2023-01-06 at 2.32.30 PM.png 

How can the "Invalid date" be removed? I already attempted to eval _time=" " in the appendpipe with no success.

Thank you.

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Don't know Dashboard Studio that much but it must be caused by the implicit conversion from numerical timestamp contained in the _time field to a human-readable string. Apparently Dashboard Studio does that differently and that causes the problem.

Let me start by saying that this way of "formatting" table is a bit ugly because it breaks the logical structure of the table. You could try to fiddle with colouring if you want to separate your data visually.

Having said that - the easiest (but still ugly ;-)) way would be to render the _time with strftime and show that field instead of _time.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Don't know Dashboard Studio that much but it must be caused by the implicit conversion from numerical timestamp contained in the _time field to a human-readable string. Apparently Dashboard Studio does that differently and that causes the problem.

Let me start by saying that this way of "formatting" table is a bit ugly because it breaks the logical structure of the table. You could try to fiddle with colouring if you want to separate your data visually.

Having said that - the easiest (but still ugly ;-)) way would be to render the _time with strftime and show that field instead of _time.

SteveBowser
Explorer

I changed the search to:

eventtype=forcepoint_messages bundleId=* WEB sender=*
| rex "WEB\-\d*\s(?<Action>\w*\s\w*\s\w*)\."
| rex "src_label\=\'(?<src_label>\S*)\'"
| eval FileName=name, JobName=Name, userName=userName
| fillnull value=" "
| eval Time = strftime(_time, "%Y-%m-%d:%H:%M:%S")
| stats count AS Count BY Time userName JobName FileName Action bundleId
| eval bundleID=bundleId
| appendpipe
[ stats sum(Count) AS Count BY bundleId
| eval userName=""]
| sort - bundleId
| fields - Count bundleId

 

And got this which will work for now.

Screenshot 2023-01-06 at 3.10.43 PM.png

As for coloring, I'm attempting to do that based on the field "bundleId" but that has really been an issue, and it's so easy to achieve that in the Classic XML. 

Thank you for the assistance!

V/R

Steve

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...