topic Re: How to display the exact date from time modifiers? in Splunk Search

How to display the exact date from time modifiers?

akarivaratharaj — Tue, 16 Apr 2019 09:09:14 GMT

I would like to know how to display the exact date of the time modifiers which are specified in the earliest and latest time range.
Eg: earliest=-1q@q latest=@q

We know that this is nothing but the last quarter details, which is earliest =01-01-2019 and latest=31-03-2019.
I am using the time modifier in my query and I want to display the above format date along with my other panels in my dashboard.
This may change according to each quarter/year we select from input.

I am using this in a case condition,

<condition>
        <eval token="growth_title2">case($result.time_period$=="earliest=-1q@q latest=@q","xxxx", $result.time_period$=="earliest=-1y@y latest=@y", "yyyy")</eval>
      </condition>

The place xxxx and yyyy needed the logic to display the earliest & latest time in date format

Could anyone please help me to display time which is mentioned in time modifier as date format.

Re: How to display the exact date from time modifiers?

harshpatel — Tue, 16 Apr 2019 09:58:48 GMT

Hi @akarivaratharaj,

Can you please try this:

<eval token="growth_title2">strftime(relative_time(now(), earliest), "%d-%m-%Y")." to ".strftime(relative_time(now(), latest), "%d-%m-%Y")</eval>

For reference:
https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/DateandTimeFunctions
https://docs.splunk.com/Documentation/Splunk/7.2.5/Viz/tokens#Define_conditional_matching

Re: How to display the exact date from time modifiers?

woodcock — Tue, 16 Apr 2019 12:31:15 GMT

I have no idea what you mean by this. More explanation is required. Perhaps show examples.

Re: How to display the exact date from time modifiers?

genesiusj — Wed, 01 Apr 2020 18:38:24 GMT

@harshpatel
I modified this for my requirements. Works like a charm.
Thanks and God bless,
Genesius

Re: How to display the exact date from time modifiers?

harshpatel — Mon, 06 Apr 2020 16:00:16 GMT

@genesiusj Glad to hear it.

Cheers,
Harsh