Eval strftime not working with Linked Search

Jack_Accent — Wed, 06 Dec 2023 05:39:19 GMT

Hello! Still very new to Splunk so hoping to get some clarification.

My dashboard is currently using a post-process search as its base and filtering data from there. On my dashboard objects, I have a <link></link> which works fine until adding an eval strftime to convert the time to human readable.

Running this search as a new search manually with the eval works fine. However, the link directs to a blank search. Removing the eval statement makes the link work.

Link:
<link target="_blank">

search?q=| inputlookup io_vuln_data_lookup where $severity$ | search last_found >= "$info_min_time$" AND last_found <= "$info_max_time$"

| eval last_found = strftime(last_found, "%c")

| table dns_name, last_found | where lower(state)!="fixed"

</link>

I was hoping to only do this conversion for a single dashboard object, so didn't want to convert the entire lookup. Would be amazing if I could get this search to work 🙂

Thanks!

Re: Eval strftime not working with Linked Search

yuanliu — Wed, 06 Dec 2023 09:38:02 GMT

In SimpleXML, certain characters must be entered with HTML entities. (Specifically, double quotes, greater than, less than, and so on.) More generally, GET URLs are best encoded without special characters. So, replace | eval last_found = strftime(last_found, "%c") with

%3D%20strftime(last_found%2C%20%22%25c%22)

Meanwhile I do not know how the cited URL could "works fine till." If you are entering these in source editor, you can try replacing double quotes with ", i.e.,

| eval last_found = strftime(last_found, "%c")

I recommend using the visual editor, however. There, you can enter SPL as SPL.

topic Eval strftime not working with Linked Search in Splunk Search

Eval strftime not working with Linked Search

Re: Eval strftime not working with Linked Search