topic Re: Time token returning NAN error in Splunk Search

Time token returning NAN error

av_ — Mon, 13 May 2024 09:37:51 GMT

I have a time picker & a time dropdown which has static values.

<panel id="pqr"> <input type="time" token="time"> <label>DateTime</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> </panel> <panel id="abc"> <input type="dropdown" token="timedrop"> <label>Time Dropdown</label> <choice value="now">Now</choice> <choice value="+3d">3d</choice> <choice value="+4d">4d</choice> <choice value="+5d">5d</choice> <default>now</default> <change> <eval token="latest_Time">if('timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval> </change> </input> </panel>

The expectation is if Now is selected in timedrop, the data till now should load. If +3d is selected in timedrop, then +3d should be added with the time.latest token (coming from the time picker) and so on.
On load (by default Today is selected), the latest_Time is returning NAN, but if I select a specific time range (say 8th April 10AM-11AM) & timedrop as 3d, it is working as expected.

Re: Time token returning NAN error

ITWhisperer — Thu, 25 Apr 2024 09:16:20 GMT

Try like this:

<panel id="pqr"> <input type="time" token="time"> <label>DateTime</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> </panel> <panel id="abc"> <title>Latest time token $latest_Time$</title> <input type="dropdown" token="timedrop"> <label>Time Dropdown</label> <choice value="now">Now</choice> <choice value="+3d">3d</choice> <choice value="+4d">4d</choice> <choice value="+5d">5d</choice> <default>now</default> <change> <eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval> </change> </input> </panel>

There doesn't seem to be a way to set an initial value on a time input - perhaps this is a bug?

Re: Time token returning NAN error

av_ — Thu, 25 Apr 2024 11:10:35 GMT

Tried this method but for some reason I still see the same error.

Re: Time token returning NAN error

ITWhisperer — Thu, 25 Apr 2024 11:26:50 GMT

All you have shown is a screen grab of something that isn't working without any detail of what you have actually tried i.e. the SimpleXML you are using in this instance. Please share some useful information.

Re: Time token returning NAN error

av_ — Thu, 25 Apr 2024 11:46:14 GMT

I've already given all the details & mentioned earlier that I used your method. To be specific, I used this below mentioned statement in the "timedrop" dropdown change section.
But still getting Nan error

<panel id="pqr"> <input type="time" token="time"> <label>DateTime</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> </panel> <panel id="abc"> <input type="dropdown" token="timedrop"> <label>Time Dropdown</label> <choice value="now">Now</choice> <choice value="+3d">3d</choice> <choice value="+4d">4d</choice> <choice value="+5d">5d</choice> <default>now</default> <change> <eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval></change> </input> </panel>

Re: Time token returning NAN error

ITWhisperer — Thu, 25 Apr 2024 11:59:50 GMT

Except that the screen grab you showed is not from this SimpleXML code

Re: Time token returning NAN error

av_ — Thu, 09 May 2024 10:16:26 GMT

@ITWhisperer I've removed the option Now from the dropdown, what should be the new eval statement instead of

<eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>

Re: Time token returning NAN error

ITWhisperer — Thu, 09 May 2024 13:53:04 GMT

If now is no longer an option, there should be no reason to check for it!

Try something like this

<eval token="latest_Time">relative_time($time.latest$, $timedrop$)</eval>

Don't forget to change the default for the dropdown to something other than now

Re: Time token returning NAN error

av_ — Mon, 13 May 2024 08:04:35 GMT

The statement is not working.

According to the above selection made, the earliest time should be 5/8/2024 05:00:00 & latest time should be 5/9/2024 06:00:00 (because the time span selected is +1d) but it is not working despite of using the below eval statement.

<eval token="latest_Time">relative_time($time.latest$, $timedrop$)</eval>

Results:

Re: Time token returning NAN error

ITWhisperer — Mon, 13 May 2024 08:11:05 GMT

Please share the source of your dashboard, just sharing screengrabs does not show what is going on behind the scenes!

Re: Time token returning NAN error

av_ — Mon, 13 May 2024 09:38:22 GMT

<form version="1.1"> <label>My dashboard</label> <fieldset submitButton="false"></fieldset> <row id="mainFilterRow" depends="$showHidePanel$"> <panel id="mainFilterPanel1"> <input type="time" token="time"> <label>DateTime</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> </panel> <panel id="mainFilterPanel21"> <input type="dropdown" token="TimeDrop"> <label>TimeDrop</label> <choice value="+1d">1d</choice> <choice value="+2d">2d</choice> <choice value="+5d">5d</choice> <default>1d</default> <change> <eval token="latest_Time">relative_time($time.latest$, $TimeDrop$)</eval> </change> </input> </panel> </row> <row id="chartRow" depends="$showHidePanel$"> <panel> <search> <query>index=main | stats count by host</query> <earliest>$time.earliest$</earliest> <latest>$latest_Time$</latest> </search> </panel> </row> </form>

Re: Time token returning NAN error

ITWhisperer — Mon, 13 May 2024 09:54:02 GMT

Try adding an init block

<init> <eval token="latest_Time">relative_time(now(), "+1d")</eval> </init>

Re: Time token returning NAN error

av_ — Fri, 24 May 2024 12:32:53 GMT

@ITWhisperer I below eval statement in init block didn't work.

  <init>
    <eval token="latest_Time">relative_time(now(), "+1d")</eval>
  </init>

I am using Javascript and there I have created two variables for earliest & latest time.

var earliestTime = defaultTokens.get("time.earliest");

var latestTime = defaultTokens.get("time.latest");

Do I need to use these variables in the Splunk dashboard in order to get the desired results?

Once again, the problem statement is that I have to add +1d to the latest time selected in the time token.

Re: Time token returning NAN error

ITWhisperer — Fri, 24 May 2024 21:05:37 GMT

In what way didn't it work?

I am not using javascript and init blocks work for me!

Re: Time token returning NAN error

av_ — Sat, 25 May 2024 18:06:55 GMT

Without using JavaScript, it works as expected but I need to use JavaScript.
I’m just assuming that due to the earliest and latest variables defined in JavaScript, the init block is not working for me.

Is there a way to solve this issue?