Re: $selection.earliest$ time formatting

tmarlette · ‎03-13-2015

I am using a 'zoom' feature within the simplified XML, and I have it working. I am simply attempting to reformat the
$selection.earliest$ and $selection.latest$ to human readable time instead of EPOCH time in order to stick it in the title of the XML panel.

Can that be done, or maybe there is another field(s) I can use to display human readable time?

Thank you!

niketn · ‎10-02-2017

@dolivasoh, @pamcarvalho, Use the <eval> tag to convert $start$ and $end$ selection times to String time using strftime() function:

       <selection>
            ...
            ...
            ...
            <eval token="selEarlStr">strftime($start$,"%Y/%m/%d %H:%M:%S %p")</eval>
            <eval token="selLatStr">strftime($end$,"%Y/%m/%d %H:%M:%S %p")</eval>
       </selection>

Then use the $selEarlStr$ and $selLatStr$ tokens to display selected time in String format.

    <html>
        ...
        ...
        <code>New Selected Time Range (String): $selEarlStr$ - $selLatStr$</code>
        ...
    </html>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

dolivasoh · ‎03-13-2015

You can use convert() to achieve this.

Syntax

convert timeformat=string...
Required arguments

Syntax: auto() | ctime() | dur2sec() | memk() | mktime() | mstime() | none() | num() | rmcomma() | rmunit() 
Description: Functions for convert.

ctime()
Syntax: ctime()
Description: Convert an epoch time to an ascii human readable time. Use the timeformat option to specify exact format to convert to.

tmarlette · ‎05-04-2015

This would need to be done in a dashboard panel 'title' screen. I'm not running a search there unfortunately.

kasu_praveen · ‎09-02-2015

Any solution for this?

pamcarvalho · ‎10-02-2017

l know it has been 2 years, but does anyone know how to do that? I am using drilldown to get data value, but when I put the value as the title, it is in Epoch, and I need it to be in human format in the table.. Can anyone help me with that?

$selection.earliest$ time formatting

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Join the Conversation