topic Re: How to use the time input field to calculate time as seconds? in Splunk Search

How to use the time input field to calculate time as seconds?

abzmhzsplunk — Thu, 09 Mar 2017 18:56:40 GMT

Hi,

In my form, I have labeled my time input as field3 such as:

     input type="time" token="field3" searchWhenChanged="true"

In the search below it, I want to calculate the time as seconds, using

 | eval time_s=$field3.latest$ - $field3.earliest$

But I got error.

Any idea how to use the Time Input field to calculate the time in seconds?

Thanks.

Re: How to use the time input field to calculate time as seconds?

woodcock — Thu, 09 Mar 2017 19:35:58 GMT

Whenever you get an error, you should report the error text, too.

Re: How to use the time input field to calculate time as seconds?

woodcock — Thu, 09 Mar 2017 19:38:16 GMT

As an alternative, you can do this instead:

... | addinfo | eval time_s = info_max_time - info_min_time

Re: How to use the time input field to calculate time as seconds?

woodcock — Thu, 09 Mar 2017 19:39:17 GMT

That should definitely work.

Re: How to use the time input field to calculate time as seconds?

DalJeanis — Thu, 09 Mar 2017 19:50:58 GMT

Upvote because for this usage, there's no reason to futz with anything else.

Re: How to use the time input field to calculate time as seconds?

niketn — Thu, 09 Mar 2017 20:29:27 GMT

I am not sure of the purpose of this calculation, however, Earliest and Latest Time selected in a Search through Input Control are available as $job.searchLatestTime$ and $job.searchEarliestTime$ in preview and finalized search event handler. You can use eval attribute to calculate time span in seconds applied to search via time input.

    <search>
      <query>|makeresults </query>
      <earliest>$field3.earliest$</earliest>
      <latest>$field3.latest$</latest>
      <sampleRatio>1</sampleRatio>
      <preview>
        <eval token="SearchSpan">$job.searchLatestTime$-$job.searchEarliestTime$</eval>  
      </preview>
    </search>

You can then use the token in your form like in the following HTML panel

  <html>
    Selected Time Span=$SearchSpan$
  </html>
</panel>

Re: How to use the time input field to calculate time as seconds?

woodcock — Thu, 09 Mar 2017 20:54:33 GMT

The really nice thing about this option is that you might have multiple timepickers and even then, you might override all of them with earliest=; this should handle every case with no thinking/planning/upkeep.