Hello,
I would like to display dates in a dashboard studio table,
i want the format to be "%Y-%m-%d" but it is not displayed as such.
Here is the spl excerpt:
| eval vuln_publication_date_string = strftime(normalized_publication_time,"%Y-%m-%d")
Here is the result of the search associated with the table. The type of the field is a string
And here the table itself. I guess it is due to the format, but i cannot change it
Does anybody have an idea how to force the format in the table ?
Thank you
I signed in just to say I had this exact problem, and your question was exactly what I was looking for. Thank you. This forum post helped answer my issue.
jowenssi Reply was what I was looking for.
I'd like to add one tip to the advice given above: Dashboard Studio will not recognize that a column is a "time" unless it's already in ISO 8601 format or some subset thereof. It's much more strict than Splunk's forwarders and indexers! You need to use strptime()/strftime() to reformat if necessary. Then, according to the not-so-easy-to-find Splunk UI docs you can use MomentJS formatting strings as shown above.
The links you provided in your "tip" are excellent!!
Thanks!! And it is really easy to format dates in a DB Studio table using the "format column" feature.
Thanks for the tip,
eholz1
I have the same issue as well. If I ever figure it out I will post. It is a real pain!
Here is on post I found, but the search uses a real string:
| makeresults | eval field1="2017-10-05T16:00:00Z"
| eval new_field=strftime(strptime(field1,"%Y-%m-%dT%H:%M:%SZ")+28800,"%Y-%m-%d %H:%M:%S")
| table new_field
I have yet to figure out how to apply this to something like this:
| eval Date = strftime(_time, "%Y-%m-%d %H:%M:%S")
the eval above works fine in a SimpleXML dashboard but NOT dashboard studio!
eholz1
Finally figured it out.
1. select the table/fied you want to format
Then get in the edit mode: look for "Column Formatting", select the field you want to format,
and click the tip icon -
Display the field enter formatting:
Success!
eholz1
here:
Using YYYY-MM-DD HH:MM:SS will yield incorrect results with the current dashboard studio version due to the overlap of Month and Minute.
The correct way would be to use: YYYY-MM-DD HH:mm:ss
@sbarnes_nj was correct in stating the format reference here: https://momentjs.com/docs/#/displaying/
This is exactly what I was looking for. Really nice doc linked. Thanks