https://community.splunk.com/t5/Splunk-Search/Converting-d-for-eval-command/m-p/499983#M195054 <P>I am trying to use the token passed through the time input in a dashboard to a search query. In this specific example, I am trying to do the following</P> <P>|eval date=strptime($timepicker.latest$,"%H:%M")</P> <P>If I select the default time as 'today' or 'yesterday', the value for timepicker is sent as <STRONG>@d</STRONG> and the eval command cannot extract the hour and minute, rather, it fails with the following </P> <P>Error in 'eval' command: The expression is malformed. An unexpected character is reached at '@d,"%H:%M")'. How can I pass through the timepicker token as a converted epoch formatted time. </P> Tue, 03 Dec 2019 05:43:37 GMT kunwarjit 2019-12-03T05:43:37Z https://community.splunk.com/t5/Splunk-Search/Converting-d-for-eval-command/m-p/499983#M195054 <P>I am trying to use the token passed through the time input in a dashboard to a search query. In this specific example, I am trying to do the following</P> <P>|eval date=strptime($timepicker.latest$,"%H:%M")</P> <P>If I select the default time as 'today' or 'yesterday', the value for timepicker is sent as <STRONG>@d</STRONG> and the eval command cannot extract the hour and minute, rather, it fails with the following </P> <P>Error in 'eval' command: The expression is malformed. An unexpected character is reached at '@d,"%H:%M")'. How can I pass through the timepicker token as a converted epoch formatted time. </P> Tue, 03 Dec 2019 05:43:37 GMT https://community.splunk.com/t5/Splunk-Search/Converting-d-for-eval-command/m-p/499983#M195054 kunwarjit 2019-12-03T05:43:37Z https://community.splunk.com/t5/Splunk-Search/Converting-d-for-eval-command/m-p/499984#M195055 <P>@kunwarjit </P> <P>Here I suggest to use <CODE>addinfo</CODE> search command. You will get time boundary as fields in epochtime. So you can use directly as per your need.</P> <P><CODE>info_min_time</CODE> : The earliest time boundary for the search.<BR /> <CODE>info_max_time</CODE> The latest time boundary for the search.</P> <PRE><CODE>| makeresults | addinfo |eval date=strftime(info_max_time,"%H:%M") </CODE></PRE> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Addinfo">https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Addinfo</A></P> <P>Thanks</P> Tue, 03 Dec 2019 12:27:49 GMT https://community.splunk.com/t5/Splunk-Search/Converting-d-for-eval-command/m-p/499984#M195055 kamlesh_vaghela 2019-12-03T12:27:49Z https://community.splunk.com/t5/Splunk-Search/Converting-d-for-eval-command/m-p/499985#M195056 <P>Coincidentally enough, code was just posted for this a few days ago here (be sure to <CODE>UpVote</CODE>:<BR /> <A href="https://answers.splunk.com/answers/786365/can-some-one-explain-me-the-function-of-the-below.html#answer-787384">https://answers.splunk.com/answers/786365/can-some-one-explain-me-the-function-of-the-below.html#answer-787384</A></P> Tue, 03 Dec 2019 16:18:45 GMT https://community.splunk.com/t5/Splunk-Search/Converting-d-for-eval-command/m-p/499985#M195056 woodcock 2019-12-03T16:18:45Z https://community.splunk.com/t5/Splunk-Search/Converting-d-for-eval-command/m-p/499986#M195057 <P>Thanks, works like a charm!</P> Tue, 03 Dec 2019 22:14:39 GMT https://community.splunk.com/t5/Splunk-Search/Converting-d-for-eval-command/m-p/499986#M195057 kunwarjit 2019-12-03T22:14:39Z