Timeslice not shown with values query on Dashboard


1 comment

  • Official comment
    Anna Truta

    Hi Geoffrey,

    In this particular example, to see time values in the dashboard chart you should add a query with the formatDate operator, and then the fields operator to specify which fields to display. 

    Here is an example:

    search query here
    | timeslice 5m
    | values(username) by _timeslice
    | formatDate(toLong(_timeslice), "yyyy-MM-dd HH:mm") as date
    | fields date, _values

    Depending on your needs, you might specify a different Timestamp Format, just like presented in the “Timestamp Format” table here.

    However, this issue looks like a bug, as there are no reasons why we would have different outcomes for the log search and the dashboard window. Please open a support case here, so that our support engineering can investigate your issue further and fix it.

    Hope that helps!

    Comment actions Permalink

Please sign in to leave a comment.