Dashboards & Visualizations

Why is there invalid date in Dashboard Studio search?

SteveBowser
Explorer

I am using the search depicted in the attached photo below to develop a viz in Dashboard Studio separating events by the field "bundleId". It appears to display events in the statistics table the way that I want them to.

Screenshot 2023-01-06 at 2.26.50 PM.png

However, when I save them to a dashboard via Dashboard Studio, I get an "Invalid Date" where I want the break in events (Note - this does not happen in the "Classic" version)

Screenshot 2023-01-06 at 2.32.30 PM.png 

How can the "Invalid date" be removed? I already attempted to eval _time=" " in the appendpipe with no success.

Thank you.

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Don't know Dashboard Studio that much but it must be caused by the implicit conversion from numerical timestamp contained in the _time field to a human-readable string. Apparently Dashboard Studio does that differently and that causes the problem.

Let me start by saying that this way of "formatting" table is a bit ugly because it breaks the logical structure of the table. You could try to fiddle with colouring if you want to separate your data visually.

Having said that - the easiest (but still ugly ;-)) way would be to render the _time with strftime and show that field instead of _time.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Don't know Dashboard Studio that much but it must be caused by the implicit conversion from numerical timestamp contained in the _time field to a human-readable string. Apparently Dashboard Studio does that differently and that causes the problem.

Let me start by saying that this way of "formatting" table is a bit ugly because it breaks the logical structure of the table. You could try to fiddle with colouring if you want to separate your data visually.

Having said that - the easiest (but still ugly ;-)) way would be to render the _time with strftime and show that field instead of _time.

SteveBowser
Explorer

I changed the search to:

eventtype=forcepoint_messages bundleId=* WEB sender=*
| rex "WEB\-\d*\s(?<Action>\w*\s\w*\s\w*)\."
| rex "src_label\=\'(?<src_label>\S*)\'"
| eval FileName=name, JobName=Name, userName=userName
| fillnull value=" "
| eval Time = strftime(_time, "%Y-%m-%d:%H:%M:%S")
| stats count AS Count BY Time userName JobName FileName Action bundleId
| eval bundleID=bundleId
| appendpipe
[ stats sum(Count) AS Count BY bundleId
| eval userName=""]
| sort - bundleId
| fields - Count bundleId

 

And got this which will work for now.

Screenshot 2023-01-06 at 3.10.43 PM.png

As for coloring, I'm attempting to do that based on the field "bundleId" but that has really been an issue, and it's so easy to achieve that in the Classic XML. 

Thank you for the assistance!

V/R

Steve

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...