All Apps and Add-ons

$selection.earliest$ time formatting


I am using a 'zoom' feature within the simplified XML, and I have it working. I am simply attempting to reformat the
$selection.earliest$ and $selection.latest$ to human readable time instead of EPOCH time in order to stick it in the title of the XML panel.

Can that be done, or maybe there is another field(s) I can use to display human readable time?

Thank you!

0 Karma

@dolivasoh, @pamcarvalho, Use the <eval> tag to convert $start$ and $end$ selection times to String time using strftime() function:

            <eval token="selEarlStr">strftime($start$,"%Y/%m/%d %H:%M:%S %p")</eval>
            <eval token="selLatStr">strftime($end$,"%Y/%m/%d %H:%M:%S %p")</eval>

Then use the $selEarlStr$ and $selLatStr$ tokens to display selected time in String format.

        <code>New Selected Time Range (String): $selEarlStr$ - $selLatStr$</code>
| makeresults | eval message= "Happy Splunking!!!"
0 Karma


You can use convert() to achieve this.


convert timeformat=string...
Required arguments

Syntax: auto() | ctime() | dur2sec() | memk() | mktime() | mstime() | none() | num() | rmcomma() | rmunit() 
Description: Functions for convert. 

Syntax: ctime()
Description: Convert an epoch time to an ascii human readable time. Use the timeformat option to specify exact format to convert to.

0 Karma


This would need to be done in a dashboard panel 'title' screen. I'm not running a search there unfortunately.

0 Karma


Any solution for this?

0 Karma

Path Finder

l know it has been 2 years, but does anyone know how to do that? I am using drilldown to get data value, but when I put the value as the title, it is in Epoch, and I need it to be in human format in the table.. Can anyone help me with that?

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: CFP Site: CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...