I was almost tempted to not report this, because I've been unable to repeat it in a small test case.
Some background: I've developed a dashboard in Splunk 8.1.0 that uses the fieldformat command with the tostring function to format a duration in a Single Value visualization.
Here's a standalone query (with the exception of the field name, the last stage is identical to my dashboard code):
| makeresults | eval seconds=12345 | fieldformat seconds=tostring(round(seconds,1),"duration")
This displays the expected value in the Single Value viz:
03:25:45.0
So far, so good.
However, when a colleague running Splunk 8.0.2 created a dashboard using exactly the same Simple XML, their viz showed the original field value 12345; apparently, ignoring the fieldformat command.
I asked my colleague to edit their dashboard source, and change fieldformat to eval. That worked.
But then, attempting to create a minimal test case for this forum, the self-contained query cited above works okay in Splunk 8.0.2. Both in the Search & Reporting app, just dynamically selecting a Single Value viz, and also when creating a new dashboard with this query behind a Single Value viz.
I'm left scratching my head. Having switched to using eval instead of fieldformat in my dashboard (because I'm not sure of the Splunk version that the intended recipient of my dashboard will be running), I'm moving on.
Still, I thought it was worth at least documenting this issue, in case anyone else has the same issue, or knows what's going on here.
Aside: Is there a way to format inline code here? I switched to the "Source code" view and manually applied <code> elements, but now the site complains "Your post has been changed because invalid HTML was found in the message body. The invalid HTML has been removed".
