Dashboards & Visualizations

Why is there invalid date in Dashboard Studio search?

SteveBowser
Explorer

I am using the search depicted in the attached photo below to develop a viz in Dashboard Studio separating events by the field "bundleId". It appears to display events in the statistics table the way that I want them to.

Screenshot 2023-01-06 at 2.26.50 PM.png

However, when I save them to a dashboard via Dashboard Studio, I get an "Invalid Date" where I want the break in events (Note - this does not happen in the "Classic" version)

Screenshot 2023-01-06 at 2.32.30 PM.png 

How can the "Invalid date" be removed? I already attempted to eval _time=" " in the appendpipe with no success.

Thank you.

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Don't know Dashboard Studio that much but it must be caused by the implicit conversion from numerical timestamp contained in the _time field to a human-readable string. Apparently Dashboard Studio does that differently and that causes the problem.

Let me start by saying that this way of "formatting" table is a bit ugly because it breaks the logical structure of the table. You could try to fiddle with colouring if you want to separate your data visually.

Having said that - the easiest (but still ugly ;-)) way would be to render the _time with strftime and show that field instead of _time.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Don't know Dashboard Studio that much but it must be caused by the implicit conversion from numerical timestamp contained in the _time field to a human-readable string. Apparently Dashboard Studio does that differently and that causes the problem.

Let me start by saying that this way of "formatting" table is a bit ugly because it breaks the logical structure of the table. You could try to fiddle with colouring if you want to separate your data visually.

Having said that - the easiest (but still ugly ;-)) way would be to render the _time with strftime and show that field instead of _time.

SteveBowser
Explorer

I changed the search to:

eventtype=forcepoint_messages bundleId=* WEB sender=*
| rex "WEB\-\d*\s(?<Action>\w*\s\w*\s\w*)\."
| rex "src_label\=\'(?<src_label>\S*)\'"
| eval FileName=name, JobName=Name, userName=userName
| fillnull value=" "
| eval Time = strftime(_time, "%Y-%m-%d:%H:%M:%S")
| stats count AS Count BY Time userName JobName FileName Action bundleId
| eval bundleID=bundleId
| appendpipe
[ stats sum(Count) AS Count BY bundleId
| eval userName=""]
| sort - bundleId
| fields - Count bundleId

 

And got this which will work for now.

Screenshot 2023-01-06 at 3.10.43 PM.png

As for coloring, I'm attempting to do that based on the field "bundleId" but that has really been an issue, and it's so easy to achieve that in the Classic XML. 

Thank you for the assistance!

V/R

Steve

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...