All Apps and Add-ons

$selection.earliest$ time formatting


I am using a 'zoom' feature within the simplified XML, and I have it working. I am simply attempting to reformat the
$selection.earliest$ and $selection.latest$ to human readable time instead of EPOCH time in order to stick it in the title of the XML panel.

Can that be done, or maybe there is another field(s) I can use to display human readable time?

Thank you!

0 Karma


@dolivasoh, @pamcarvalho, Use the <eval> tag to convert $start$ and $end$ selection times to String time using strftime() function:

            <eval token="selEarlStr">strftime($start$,"%Y/%m/%d %H:%M:%S %p")</eval>
            <eval token="selLatStr">strftime($end$,"%Y/%m/%d %H:%M:%S %p")</eval>

Then use the $selEarlStr$ and $selLatStr$ tokens to display selected time in String format.

        <code>New Selected Time Range (String): $selEarlStr$ - $selLatStr$</code>
| makeresults | eval message= "Happy Splunking!!!"
0 Karma


You can use convert() to achieve this.


convert timeformat=string...
Required arguments

Syntax: auto() | ctime() | dur2sec() | memk() | mktime() | mstime() | none() | num() | rmcomma() | rmunit() 
Description: Functions for convert. 

Syntax: ctime()
Description: Convert an epoch time to an ascii human readable time. Use the timeformat option to specify exact format to convert to.

0 Karma


This would need to be done in a dashboard panel 'title' screen. I'm not running a search there unfortunately.

0 Karma


Any solution for this?

0 Karma

Path Finder

l know it has been 2 years, but does anyone know how to do that? I am using drilldown to get data value, but when I put the value as the title, it is in Epoch, and I need it to be in human format in the table.. Can anyone help me with that?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!