<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: eval Not working with time functions while evaluating the tokens in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347519#M22664</link>
    <description>&lt;P&gt;It worked with the below:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;        &amp;lt;set token="JMS_ID"&amp;gt;$row.JMSID$&amp;lt;/set&amp;gt;
        &amp;lt;set token="show_transaction"&amp;gt;true&amp;lt;/set&amp;gt;
        &amp;lt;unset token="show_correlated"&amp;gt;&amp;lt;/unset&amp;gt;
        &amp;lt;set token="StartTime"&amp;gt;$row.StartTime$&amp;lt;/set&amp;gt;
        &amp;lt;eval token="token_starttime"&amp;gt;relative_time(strptime($StartTime$,"%Y/%m/%dT%H:%M:%S"),"-5m")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="token_endtime"&amp;gt;relative_time(strptime($StartTime$,"%Y/%m/%dT%H:%M:%S"),"+1h")&amp;lt;/eval&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Set token first and then use that token in the eval command. I am using the below tokens in the drilldown panel.&lt;/P&gt;

&lt;P&gt;token_starttime&lt;BR /&gt;
token_endtime&lt;/P&gt;

&lt;P&gt;Thanks all for your help.&lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 19:07:56 GMT</pubDate>
    <dc:creator>varun99</dc:creator>
    <dc:date>2020-09-29T19:07:56Z</dc:date>
    <item>
      <title>eval Not working with time functions while evaluating the tokens</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347513#M22658</link>
      <description>&lt;P&gt;I have a panel which provides us a list of transactions along with the StartTime of the transactions. I want a drill down panel which searches for a specific transaction within the time range (StartTime - 5 minutes) to (StartTime + 1 hour).&lt;/P&gt;

&lt;P&gt;Please note that the StartTime is a field listed in the first panel with the format. "YYYY/mm/dd HH:MM:SS.sss".&lt;/P&gt;

&lt;P&gt;I tried eval the startTime and EndTime of the second panel in the tokens like below:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;        &amp;lt;set token="JMS_ID"&amp;gt;$row.JMSID$&amp;lt;/set&amp;gt;
        &amp;lt;eval token="StartTime"&amp;gt;strptime($row.StartTime$, "%Y/%m/%d %H:%M:%S.%3Q")-600&amp;lt;/eval&amp;gt;
        &amp;lt;set token="show_transaction"&amp;gt;true&amp;lt;/set&amp;gt;
        &amp;lt;unset token="show_correlated"&amp;gt;&amp;lt;/unset&amp;gt;
        &amp;lt;eval token="EndTime"&amp;gt;strptime($row.StartTime$, "%Y/%m/%d %H:%M:%S.%3Q")+3600&amp;lt;/eval&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I am providing the input to the second panel as below:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;      &amp;lt;earliest&amp;gt;$StartTime$&amp;lt;/earliest&amp;gt;
      &amp;lt;latest&amp;gt;$EndTime$&amp;lt;/latest&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;But it's not working. The search is not even starting. It says "Search is waiting for input..."&lt;/P&gt;</description>
      <pubDate>Wed, 18 Apr 2018 02:03:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347513#M22658</guid>
      <dc:creator>varun99</dc:creator>
      <dc:date>2018-04-18T02:03:21Z</dc:date>
    </item>
    <item>
      <title>Re: eval Not working with time functions while evaluating the tokens</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347514#M22659</link>
      <description>&lt;P&gt;Are you intentionally using &lt;CODE&gt;$row.StartTime$&lt;/CODE&gt; for both Start and End time? In your XML, you appear to be using that for both, with no modification (beyond parsing with strptime).&lt;/P&gt;</description>
      <pubDate>Wed, 18 Apr 2018 02:20:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347514#M22659</guid>
      <dc:creator>elliotproebstel</dc:creator>
      <dc:date>2018-04-18T02:20:45Z</dc:date>
    </item>
    <item>
      <title>Re: eval Not working with time functions while evaluating the tokens</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347515#M22660</link>
      <description>&lt;P&gt;Also - you have put all of that inside a &lt;CODE&gt;&amp;lt;condition&amp;gt;&lt;/CODE&gt; element with no actual condition defined. I think that's likely your biggest problem. You need to either define a triggering condition or just wrap that in a drilldown with no condition.&lt;/P&gt;</description>
      <pubDate>Wed, 18 Apr 2018 02:22:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347515#M22660</guid>
      <dc:creator>elliotproebstel</dc:creator>
      <dc:date>2018-04-18T02:22:26Z</dc:date>
    </item>
    <item>
      <title>Re: eval Not working with time functions while evaluating the tokens</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347516#M22661</link>
      <description>&lt;P&gt;Thanks for your reply.&lt;/P&gt;

&lt;P&gt;The condition is fine as it is the ELSE part. Similar eval statements are there in the conditional part as well. I have updated the question to remove the condition statement as it may confuse other people.&lt;/P&gt;

&lt;P&gt;And yes I am intentional using $row.StartTime$ for both Start and EndTime. Modification that have to be there are added in the questions above.&lt;/P&gt;</description>
      <pubDate>Wed, 18 Apr 2018 02:34:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347516#M22661</guid>
      <dc:creator>varun99</dc:creator>
      <dc:date>2018-04-18T02:34:09Z</dc:date>
    </item>
    <item>
      <title>Re: eval Not working with time functions while evaluating the tokens</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347517#M22662</link>
      <description>&lt;P&gt;Hmm, in that case, can you share the query you're using in the drilldown panel? Does it use a token that might not be getting set? &lt;/P&gt;</description>
      <pubDate>Wed, 18 Apr 2018 02:48:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347517#M22662</guid>
      <dc:creator>elliotproebstel</dc:creator>
      <dc:date>2018-04-18T02:48:45Z</dc:date>
    </item>
    <item>
      <title>Re: eval Not working with time functions while evaluating the tokens</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347518#M22663</link>
      <description>&lt;P&gt;Try this as your calculation - &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;tonumber(strptime($row.StartTime$, "%Y/%m/%d %H:%M:%S.%3Q")) - 600
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 18 Apr 2018 03:26:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347518#M22663</guid>
      <dc:creator>DalJeanis</dc:creator>
      <dc:date>2018-04-18T03:26:04Z</dc:date>
    </item>
    <item>
      <title>Re: eval Not working with time functions while evaluating the tokens</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347519#M22664</link>
      <description>&lt;P&gt;It worked with the below:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;        &amp;lt;set token="JMS_ID"&amp;gt;$row.JMSID$&amp;lt;/set&amp;gt;
        &amp;lt;set token="show_transaction"&amp;gt;true&amp;lt;/set&amp;gt;
        &amp;lt;unset token="show_correlated"&amp;gt;&amp;lt;/unset&amp;gt;
        &amp;lt;set token="StartTime"&amp;gt;$row.StartTime$&amp;lt;/set&amp;gt;
        &amp;lt;eval token="token_starttime"&amp;gt;relative_time(strptime($StartTime$,"%Y/%m/%dT%H:%M:%S"),"-5m")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="token_endtime"&amp;gt;relative_time(strptime($StartTime$,"%Y/%m/%dT%H:%M:%S"),"+1h")&amp;lt;/eval&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Set token first and then use that token in the eval command. I am using the below tokens in the drilldown panel.&lt;/P&gt;

&lt;P&gt;token_starttime&lt;BR /&gt;
token_endtime&lt;/P&gt;

&lt;P&gt;Thanks all for your help.&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 19:07:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/eval-Not-working-with-time-functions-while-evaluating-the-tokens/m-p/347519#M22664</guid>
      <dc:creator>varun99</dc:creator>
      <dc:date>2020-09-29T19:07:56Z</dc:date>
    </item>
  </channel>
</rss>

