Timeslice not shown with values query on Dashboard

Follow

Geoffrey Wiseman

• June 17, 2022 18:38

I was looking at ways to show recent logins on a SumoLogic dashboard. I can query login information out of a log. In order to put that search on a dashboard panel, it has to be an aggregate query, so I did a values by timeslice:

search query here
| timeslice 5m 
| values(username) by _timeslice

In the log viewer, the data looks fine:

But if I add it to the dashboard, the timeslice data vanishes, leaving an empty time column:

Why? Can I fix it?

0

• Official comment

  

  Anna Truta

  • October 26, 2022 16:34

  Hi Geoffrey,

  In this particular example, to see time values in the dashboard chart you should add a query with the formatDate operator, and then the fields operator to specify which fields to display. 

  Here is an example:

  search query here
  | timeslice 5m
  | values(username) by _timeslice
  | formatDate(toLong(_timeslice), "yyyy-MM-dd HH:mm") as date
  | fields date, _values

  Depending on your needs, you might specify a different Timestamp Format, just like presented in the “Timestamp Format” table here.

  However, this issue looks like a bug, as there are no reasons why we would have different outcomes for the log search and the dashboard window. Please open a support case here, so that our support engineering can investigate your issue further and fix it.

  Hope that helps!

  
  
  
  
  
  
  

  Comment actions Permalink

Please sign in to leave a comment.