topic Re: How to format "snap to time" to string in dashboard panel title. in Dashboards & Visualizations

How to format "snap to time" to string in dashboard panel title.

GersonGarcia — Thu, 13 Jul 2017 17:02:04 GMT

Hello all,

I am designing a dashboard that will use a timer pick to build search. I would like to show in the panel title the time in the same format as any Search:

7/6/17 9:00:00.000 AM to 7/13/17 9:19:00.000 AM

But when I add the timer in the title I am getting the "snap to time" format:

Between $timer.earliest$ and $timer.latest$

=

Between -7d@h and now

Is there anyway I can format it to string? I tried feel combinations, but they didn't work:

1st:

  <row>
    <panel>
      <title>Select Desired Time of oom-killer Invocation</title>
      <table>
        <title>Between strftime($timer.earliest$,"%c") and strftime($timer.latest$,"%c")</title>
        <search>


Output:

Between strftime(-7d@h,"%c") and strftime(now,"%c")

2nd:

    <input type="time" token="timer" searchWhenChanged="true">
      <label>Timeframe</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <unset token="SearchHost"></unset>
        <unset token="tssnservice"></unset>
        <eval token="searliest">strftime(earliest,"%c")</eval>
        <eval token="slatest">strftime(latest,"%c")</eval>
      </change>
    </input>
...

      <table>
        <title>Between $searliest$ and $slatest$</title>
        <search>
...


OUTPUT:

Between Invalid date and Invalid date

and...

    <input type="time" token="timer" searchWhenChanged="true">
      <label>Timeframe</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <unset token="SearchHost"></unset>
        <unset token="tssnservice"></unset>
        <eval token="searliest">'strftime(earliest,"%c")'</eval>
        <eval token="slatest">'strftime(latest,"%c")'</eval>
      </change>
    </input>
...
      <table>
        <title>Between $searliest$ and $slatest$</title>
        <search>
...

OUTPUT:

Between $searliest$ and $slatest$

Is there any other option?

Thank you,

Gerson

Re: How to format "snap to time" to string in dashboard panel title.

sbbadri — Thu, 13 Jul 2017 18:52:21 GMT

  <label>Time Range:</label>
  <default>
    <earliestTime>-1d@d</earliestTime>
    <latestTime>@d</latestTime>
  </default>
  <change>
      <!-- use predefined input tokens to set -->
      <!-- tokens for the selected label and value -->
      <set token="date_label">$label$</set>
      <set token="earliest_tok">$value$</set>
  </change>

Re: How to format "snap to time" to string in dashboard panel title.

GersonGarcia — Fri, 14 Jul 2017 01:17:03 GMT

No, that is not what the timer pick sets. it sets 2 variables:

        <earliest>-7d@h</earliest>
        <latest>now</latest>

The provided code works for dropdown lists.

Thank you,

Re: How to format "snap to time" to string in dashboard panel title.

rgaffur — Tue, 30 Oct 2018 15:56:03 GMT

First attempt...

  <title>All Commands Last from $allCommandsEarliestLabel$ to $allCommandsLatestLabel$</title>
  <chart id="allCommandMaster">
    <search id="passBaseSearch">
      <query>index=...|stats count by command</query>
      <earliest>$command_token.earliest$</earliest>
      <latest>$command_token.latest$</latest>
      <progress>
        <eval token="allCommandsEarliestLabel">if(isnum($command_token.earliest$),strftime($command_token.earliest$,"%d/%m/%Y %H:%M:%S"),$command_token.earliest$)</eval>
        <eval token="allCommandsLatestLabel">if(isnum($command_token.latest$),strftime($command_token.latest$,"%d/%m/%Y %H:%M:%S"),$command_token.latest$)</eval>
      </progress>
    </search>

Re: How to format "snap to time" to string in dashboard panel title.

rgaffur — Tue, 30 Oct 2018 22:12:57 GMT

Second attempt...
We need to check if the timepicker variable is an Epoch number or a Splunk artifact like “-7d@d” or “now”.
If the variable is an Epoch number, we convert it to a date using strftime.
If the variable is a String, we need to convert it into an Epoch number using relative_time, then into a date.

      <earliest>$command_token.earliest$</earliest>
      <latest>$command_token.latest$</latest>
      <progress>
        <eval token="allCommandsEarliestLabel">
          if(isnum($command_token.earliest$),strftime($command_token.earliest$,"%d/%m/%Y %H:%M:%S"),strftime(relative_time(now(), $command_token.earliest$),"%m/%d/%Y %H:%M:%S"))
        </eval>
        <eval token="allCommandsLatestLabel">
          if(isnum($command_token.latest$),strftime($command_token.latest$,"%m/%d/%Y %H:%M:%S"),strftime(relative_time(now(), "@sec"),"%m/%d/%Y %H:%M:%S"))
        </eval>
      </progress>