All Apps and Add-ons

Using the Demisto Add-on, why am I getting the following error when passing a token to the "Occured Time" field: "Enter valid epoch time for duration"

swong2
Path Finder

I tried to pass the result token $result._time$ to the "Occured Time" field, but got the following error: "Enter valid epoch time for duration" while saving. It seems to me that the input only accepts epoch value, but that shouldn't prevent me from passing a token from the search result.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@swong2

Can you please try following approach?

1) Store _time in another field.eg YOUR_SEARCH | eval TIME=_time
2) Use TIME to pass _time's value eg. $result.TIME$

Thanks

0 Karma

swong2
Path Finder

It didn't work.

0 Karma

swong2
Path Finder

I believe the problem is in config file splunk/etc/apps/TA-Demisto/default/restmap.conf

Validation

[validation:savedsearch]
action.demisto.param.occured = validate( match('action.demisto.param.occured', "((^[0-9]*$)|(\$trigger_time\$?)$)"), "Enter valid epoch time for duration")

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please share your sample search & XML code ?

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...