Dashboards & Visualizations

How to display day , month and time in single value tile

jaibalaraman
Path Finder

Hi 

 

How to display the day / month / time / year like the below format using simple format 

 

Ex- | make result 

jaibalaraman_0-1730779659064.png

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jaibalaraman ,

you have to change the time format in strftime command applying the format you like following the formats at https://docs.splunk.com/Documentation/Splunk/9.3.1/SearchReference/Commontimeformatvariables :

| makeresults
| eval refresh_time=strftime(_time, "%A,%d/%m/%Y %Z %H:%M:%S") 
| table refresh_time

 Ciao.

Giuseppe

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. But what is your issue here?

You have a timestamp but don't know how to render it into text with a given format? For that you use either eval or fieldformat with a strftime function.

Or you already have a string value but have some problems with putting it on a dashboard? (what problems exactly?)

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jaibalaraman ,

you have to use the table command and the field containing the date to display:

<your_search>
| table timestamp

There's on ly one problem I can see: having a long string like the one you shared, chars in the Single Value will be very small.

Maybe you could use more than one Single Value displaying parts of the timestamp.

Ciao.

Giuseppe

0 Karma

jaibalaraman
Path Finder

Hi All 

I running the below command 

| makeresults
| eval refresh_time=strftime(_time, "%A,%Y-%m-%d %H:%M:%S") | table refresh_time



jaibalaraman_0-1730852167574.png

 

 

How to change the position like below 

Tuesday , 11/05/2024 NZST 22:12:39

 

Thanks

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jaibalaraman ,

you have to change the time format in strftime command applying the format you like following the formats at https://docs.splunk.com/Documentation/Splunk/9.3.1/SearchReference/Commontimeformatvariables :

| makeresults
| eval refresh_time=strftime(_time, "%A,%d/%m/%Y %Z %H:%M:%S") 
| table refresh_time

 Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jaibalaraman ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...