<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Dashboard TimePicker using always the UTC in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-TimePicker-using-always-the-UTC/m-p/555978#M38645</link>
    <description>&lt;P&gt;It looks like you are missing some $s around token names - I don't know if the following will work, but you could try using replace instead of rex?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;        &amp;lt;eval token="UTCtime"&amp;gt;$MYtime$&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="UTCtime"&amp;gt;replace($UTCtime$,"\s+\S+$"," UTC")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="UTC_time"&amp;gt;strptime($UTCtime$, "%m/%d/%Y %H:%M:%S %Z")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="TZdelta"&amp;gt;round(now() - $UTC_time$, 0)&amp;lt;/eval&amp;gt;&lt;/LI-CODE&gt;</description>
    <pubDate>Wed, 16 Jun 2021 13:15:30 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2021-06-16T13:15:30Z</dc:date>
    <item>
      <title>Dashboard TimePicker using always the UTC</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-TimePicker-using-always-the-UTC/m-p/555967#M38644</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;&lt;P&gt;I need the dashboard time picker to use always the UTC time independent on the user TZ.&amp;nbsp;&lt;/P&gt;&lt;P&gt;How would I do this?&lt;/P&gt;&lt;P&gt;Could someone paste the corresponding code?&lt;/P&gt;&lt;P&gt;I was trying to copy paste some code that I found in the google, see below, but I am failing on the translation of the SPL into the dashboard XML commands. Like e.g. the below would not execute the regex properly - I mean I would not know how to do this. Then the UTCtime does not get set and the following commands are not working.&lt;/P&gt;&lt;P&gt;Any ideas?&lt;/P&gt;&lt;P&gt;Kind Regards,&lt;/P&gt;&lt;P&gt;Kamil&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;    &amp;lt;input type="time" token="date_time" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Time&amp;lt;/label&amp;gt;
      &amp;lt;default&amp;gt;
        &amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;
        &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
      &amp;lt;/default&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;eval token="MYtime"&amp;gt;strftime(now(), "%m/%d/%Y %H:%M:%S %Z")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="UTCtime"&amp;gt;MYtime&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="UTCtime"&amp;gt;rex field=UTCtime mode=sed "s/\s+\S+$/ UTC/"&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="UTC_time"&amp;gt;strptime(UTCtime, "%m/%d/%Y %H:%M:%S %Z")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="TZdelta"&amp;gt;round(_time - UTC_time, 0)&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="earliestUTC"&amp;gt;'earliest' + $TZdelta$&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="latestUTC"&amp;gt;'latest' + $TZdelta$&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="form.from"&amp;gt;strftime(relative_time(now(),'earliest'), "%F %T")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="form.to"&amp;gt;strftime(relative_time(now(),'latest'), "%F %T")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="stop_ts_from"&amp;gt;relative_time(now(),'earliest')*1000&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="stop_ts_to"&amp;gt;relative_time(now(),'latest')*1000&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="curr_date_from"&amp;gt;strftime($stop_ts_from$/1000,"%Y%m%d")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="curr_date_to"&amp;gt;strftime($stop_ts_to$/1000,"%Y%m%d")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="timediff"&amp;gt;strptime($form.to$, "%Y-%m-%d %H:%M:%S")  - strptime($form.from$, "%Y-%m-%d %H:%M:%S")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="secbetween"&amp;gt;$timediff$/1800&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="timegran"&amp;gt;case($secbetween$ &amp;amp;lt; 60, 1,$secbetween$ &amp;amp;lt; 300,5, $secbetween$ &amp;amp;lt; 600,10,$secbetween$&amp;amp;lt;1800,30,$secbetween$&amp;amp;lt;3600,60,$secbetween$&amp;amp;lt;7200,120,$secbetween$&amp;amp;lt;10800,180,$secbetween$&amp;amp;lt;21600,360$secbetween$&amp;amp;lt;43200,720,$secbetween$&amp;amp;lt;86400,1440,$secbetween$&amp;amp;gt;86400,1440)&amp;lt;/eval&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 16 Jun 2021 12:53:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-TimePicker-using-always-the-UTC/m-p/555967#M38644</guid>
      <dc:creator>damucka</dc:creator>
      <dc:date>2021-06-16T12:53:28Z</dc:date>
    </item>
    <item>
      <title>Re: Dashboard TimePicker using always the UTC</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-TimePicker-using-always-the-UTC/m-p/555978#M38645</link>
      <description>&lt;P&gt;It looks like you are missing some $s around token names - I don't know if the following will work, but you could try using replace instead of rex?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;        &amp;lt;eval token="UTCtime"&amp;gt;$MYtime$&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="UTCtime"&amp;gt;replace($UTCtime$,"\s+\S+$"," UTC")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="UTC_time"&amp;gt;strptime($UTCtime$, "%m/%d/%Y %H:%M:%S %Z")&amp;lt;/eval&amp;gt;
        &amp;lt;eval token="TZdelta"&amp;gt;round(now() - $UTC_time$, 0)&amp;lt;/eval&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 16 Jun 2021 13:15:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-TimePicker-using-always-the-UTC/m-p/555978#M38645</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-06-16T13:15:30Z</dc:date>
    </item>
  </channel>
</rss>

