topic Convert epoch time from drilldown parameter in Splunk Search

Convert epoch time from drilldown parameter

feickertmd — Tue, 18 Nov 2014 18:48:23 GMT

I have set up a drilldown to jump from a timechart graph to another dashboard.
<link> <![CDATA[ /app/SPSearchData/drilldown_search_and_results?status=$click.name2$&earliest=$earliest$&latest=$latest$ ]]> </link> </drilldown>

The resulting URL for the target dashboard displays like this:
/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000#en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000

Note that the earliest and latest params are set to Epoch time. I would like to have a HTML label above the chart that uses tokens to update ("$status$ from $earliest$ to $latest$"). My problem is that it comes up like:
Abandoned searches from 1395205200 to 1395810000

Is there any way I can format those epoch timestamps to be able to display them to the user in a readable format?

Re: Convert epoch time from drilldown parameter

martin_mueller — Tue, 18 Nov 2014 18:59:39 GMT

You could add a time range picker and feed your tokens into that, that way the user can both see the time range (to some degree) and manipulate it as well.

Re: Convert epoch time from drilldown parameter

feickertmd — Tue, 18 Nov 2014 19:11:04 GMT

I tried that with this:
<input type="time" token="time_token"> <label /> <default> <earliestTime>$earliest$</earliestTime> <latestTime >$latest$</latestTime> </default> </input>

I had done that, but I realize now that I had to redefine how I was passing tokens. I was getting
http://apsrd3084:8000/en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1393999200&latest=1394600400#en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1393999200&latest=1394600400&form.time_token.earliest=%24earliest%24&form.time_token.latest=%24latest%24

I needed to change the sending form to send the tokens in the proper format.

Thanks again!

Re: Convert epoch time from drilldown parameter

martin_mueller — Tue, 18 Nov 2014 19:13:55 GMT

You can save yourself some customization if you leave off the custom token name for the time input... assuming that's the only time range picker on the dashboard.