All Apps and Add-ons

$selection.earliest$ time formatting

tmarlette
Motivator

I am using a 'zoom' feature within the simplified XML, and I have it working. I am simply attempting to reformat the
$selection.earliest$ and $selection.latest$ to human readable time instead of EPOCH time in order to stick it in the title of the XML panel.

Can that be done, or maybe there is another field(s) I can use to display human readable time?

Thank you!

0 Karma

@dolivasoh, @pamcarvalho, Use the <eval> tag to convert $start$ and $end$ selection times to String time using strftime() function:

       <selection>
            ...
            ...
            ...
            <eval token="selEarlStr">strftime($start$,"%Y/%m/%d %H:%M:%S %p")</eval>
            <eval token="selLatStr">strftime($end$,"%Y/%m/%d %H:%M:%S %p")</eval>
       </selection>

Then use the $selEarlStr$ and $selLatStr$ tokens to display selected time in String format.

    <html>
        ...
        ...
        <code>New Selected Time Range (String): $selEarlStr$ - $selLatStr$</code>
        ...
    </html>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

dolivasoh
Contributor

You can use convert() to achieve this.

Syntax

convert timeformat=string...
Required arguments

Syntax: auto() | ctime() | dur2sec() | memk() | mktime() | mstime() | none() | num() | rmcomma() | rmunit() 
Description: Functions for convert. 

ctime()
Syntax: ctime()
Description: Convert an epoch time to an ascii human readable time. Use the timeformat option to specify exact format to convert to.

0 Karma

tmarlette
Motivator

This would need to be done in a dashboard panel 'title' screen. I'm not running a search there unfortunately.

0 Karma

kasu_praveen
Communicator

Any solution for this?

0 Karma

pamcarvalho
Path Finder

l know it has been 2 years, but does anyone know how to do that? I am using drilldown to get data value, but when I put the value as the title, it is in Epoch, and I need it to be in human format in the table.. Can anyone help me with that?

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...