topic Re: How to use eval on a token from a time picker and add it to a label for a chart? in Dashboards & Visualizations

How to use eval on a token from a time picker and add it to a label for a chart?

KevinAdu — Tue, 15 Dec 2015 08:13:08 GMT

In my Splunk Dashboard, I have a time picker and charts which shows a search for each subsequent day from the earliest time selected in the time picker.

I want to display a formatted date in a label for each chart. So for example:

Day 1 - 15/12/2015
Day 2 - 16/12/2015
Day 3 - 17/12/2015
etc

I understand that these dates can be derived from the time picker's token. Here is what I have attempted so far just for the first date but it does not seem to work:

<input type="time" token="InputTime">
      <label>TimePicker for SourceType</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <eval token="new_time">strptime($InputTime.earliest$, "%m/%d/%Y")</eval>
        <title>Day 1 - $new_time$</title>

Could anybody tell me what I am doing wrong?
Thanks

Re: How to use eval on a token from a time picker and add it to a label for a chart?

masonmorales — Thu, 17 Dec 2015 18:30:08 GMT

I'm not sure if you can perform an eval on a time token to convert it to another time format... I know that you can do this though:

 <input type="time" token="InputTime">
       <label>TimePicker for SourceType</label>
       <default>
         <earliest>-15m</earliest>
         <latest>now</latest>
       </default>
     </input>
   </fieldset>
   <row>
     <panel>
       <chart>
         <title>Day 1 - $InputTime.earliest$ to $InputTime.latest$</title>

Re: How to use eval on a token from a time picker and add it to a label for a chart?

KevinAdu — Mon, 21 Dec 2015 00:52:46 GMT

Yeah but the issue is that will show it in the unix timestamp format. So I was hoping I could change it to make it more readable.

Where I saw the eval command being used that way was on this page:

http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/tokens

Re: How to use eval on a token from a time picker and add it to a label for a chart?

JovanMilosevic — Fri, 26 Feb 2016 12:06:35 GMT

I know it's been a while, but might help someone else. Just been wrestling with similar problem. I've found that evals need to be inside the input block. Also, when tokens are used there, they need to be in single quotes. Finally, it's strftime rather than strptime. Try...

<input type="time" token="InputTime">
       <label>TimePicker for SourceType</label>
       <default>
         <earliest>-15m</earliest>
         <latest>now</latest>
       </default>
       <change>
         <eval token="new_time">strftime('InputTime.earliest', "%m/%d/%Y")</eval> 
       </change>
  </input>
   </fieldset>
   <row>
     <panel>
       <chart>
         <title>Day 1 - $new_time$</title>

Re: How to use eval on a token from a time picker and add it to a label for a chart?

rmarcum — Mon, 11 Jul 2016 21:49:54 GMT

Hi JovanMilosevic, did this indeed work for you? We are looking for your secret. (-: Please check question:

https://answers.splunk.com/answers/425146/simple-xml-dashboard-eval-strptime-using-old-value.html

Best Regards

Re: How to use eval on a token from a time picker and add it to a label for a chart?

gcusello — Tue, 12 Jul 2016 08:51:29 GMT

Try to insert eval command in the search of a panel and then extract the token in the panel and show it in the panel's title.
But if you do this, you have to manage the showed columns to don't see the value in a column: in this case you have to use the <fields> option
Bye.
Giuseppe