topic Re: Dashboard not showing date correctly in Dashboards & Visualizations

Dashboard not showing date correctly

balash1979 — Wed, 27 Nov 2019 20:56:33 GMT

I am using the following code in my dashboard

 <search>
 <query>| makeresults</query>
 <earliest>$field1.earliest$</earliest>
 <latest>$field1.latest$</latest>
 <done>
  <eval token="tokTime">$job.earliestTime$</eval>
  <eval token="tokEarliestTime">strftime(strptime($job.earliestTime$,"%Y/%m/%dT%H:%M:%S %p"),"%m/%d/%y %I:%M:%S %p") 
 </eval>
  <eval token="tokLatestTime">strftime(strptime($job.latestTime$,"%Y/%m/%dT%H:%M:%S %p"),"%m/%d/%y %I:%M:%S %p")</eval>
</done>
</search>

In my panel, i use this

<title>from $tokEarliestTime$ to $tokLatestTime$</title>

When I save my dashboard it shows up as
from invalid date to invalid date

Do I need to change any personal settings in splunk to get this working ?

Re: Dashboard not showing date correctly

woodcock — Wed, 27 Nov 2019 21:40:00 GMT

Try this:

<search>
 <query>| makeresults</query>
 <earliest>$field1.earliest$</earliest>
 <latest>$field1.latest$</latest>
 <done>
  <eval token="tokTime">$job.earliestTime$</eval>
  <eval token="tokEarliestTime">strftime($job.earliestTime$,"%Y/%m/%dT%H:%M:%S %p")</eval>
  <eval token="tokLatestTime">strftime($job.latestTime$,"%Y/%m/%dT%H:%M:%S %p")</eval>
</done>

And then this:

<title>from $tokEarliestTime$ to $tokLatestTime$</title>

Re: Dashboard not showing date correctly

balash1979 — Wed, 27 Nov 2019 23:18:48 GMT

Same issue as before. it says invalid date in the dashboard.
Sounds like some server side settings that need to change ?

Re: Dashboard not showing date correctly

vnravikumar — Thu, 28 Nov 2019 04:56:19 GMT

Try this

<form>
  <label>date</label>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>from $tokEarliest$ to $tokLatest$</title>
      <table>
        <search>
          <query>| makeresults</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <done>
            <eval token="tokTime">$job.earliestTime$</eval>
            <eval token="tokEarliest">strftime(strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S %p")</eval>
            <eval token="tokLatest">strftime(strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S %p")</eval>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>