topic Re: How to convert time based on selected time span token? in Dashboards & Visualizations

How to convert time based on selected time span token?

auaave — Tue, 06 Mar 2018 03:21:41 GMT

Hi Guys,

I am creating a dashboard with time span token $bin$ = 1h or 1w or 1d or 1m. How can I convert the time based on the selected token? 1h - %H , 1d - %d , 1w - %V , 1m - %b

Thanks!

| search $group$
| bin _time span=$bin$ 
| eval Time=strftime(_time,"%V") 
| chart count as eventcount over DESCRIPTION by Time

Re: How to convert time based on selected time span token?

p_gurav — Tue, 06 Mar 2018 06:27:04 GMT

Hi,

This link will helpful for you:
https://answers.splunk.com/answers/576752/how-to-compare-time-range-picker-to-change-span-of.html

Re: How to convert time based on selected time span token?

HiroshiSatoh — Tue, 29 Sep 2020 18:14:55 GMT

Is it like this?
Please add CASE.

<input type="dropdown" token="span">
  <label>XXX</label>
  <choice value="1h">1h</choice>
  <choice value="1d">1d</choice>
  <change>
    <eval token="time_format">case($span$="1h","%H",$span$="1d","%d")</eval>
  </change>
</input>

|eval Time=strftime(_time,"$time_format$")

Re: How to convert time based on selected time span token?

auaave — Wed, 07 Mar 2018 05:53:12 GMT

@HiroshiSatoh, this is exactly what I need. Thanks a lot 🙂

Re: How to convert time based on selected time span token?

auaave — Wed, 07 Mar 2018 05:53:39 GMT

thanks @ p_gurav 🙂