topic time token conversion and displaying in title in Splunk Search

time token conversion and displaying in title

mortenb123 — Thu, 03 Mar 2016 12:55:46 GMT

Hi All

How do I get $time1$ and $time2$to display in my panel title?
I've also tried with strftime(), but without success, I mostly worked with snapped timestamps,

  <fieldset submitButton="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label>Timeintervall</label>
      <default>
        <earliest>-2d@d</earliest>
        <latest>-1d@d</latest>
      </default>
      <change>
        <eval token="time1">relative_time(now(),"$field1.earliest$")</eval>
        <eval token="time2">relative_time(now(),"$field1.latest$")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>ID&amp;Payment app Successful $time1$ to $time2$</title>

It will only show either "" 0 or just show the variable.

Thanks

Re: time token conversion and displaying in title

mortenb123 — Tue, 15 Mar 2016 08:38:50 GMT

Anyone have a workaround, or solution here. in earlier versions of Splunk the timepicker wrote the iso timerange when the picker could not snap it.
I have lots of boards and it is very irritating that I cant write the timerange properly other than showing the snap values.

Re: time token conversion and displaying in title

chimell — Tue, 15 Mar 2016 08:53:02 GMT

Hi
I rectified just copy the search code below and test in your splunk web . It works well

<form>
<fieldset submitButton="false">
     <input type="time" token="field1" searchWhenChanged="true">
       <label>Timeintervall</label>
       <default>
         <earliest>-2d@d</earliest>
         <latest>-1d@d</latest>
       </default>
       <change>
         <eval token="time1">relative_time(now(),"-2d@d")</eval>
         <eval token="time2">relative_time(now(),"-1d@d")</eval>
       </change>
     </input>
   </fieldset>
   <row>
     <panel>
       <table>
         <title>Payment app Successful $time1$ to $time2$</title>

         <searchString>index=_internal|stats count by user</searchString>
         <earliestTime>$time1$</earliestTime>
         <latestTime>$time2$</latestTime>
       </table>
     </panel>
      </row>
     </form>

Look at the result

Re: time token conversion and displaying in title

mortenb123 — Tue, 15 Mar 2016 14:07:50 GMT

Thanks, is it possible to then drop the first part, the field1 token and only use time1 and time2. Because the first one is not used.