Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Re: $selection.earliest$ time formatting
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
$selection.earliest$ time formatting
I am using a 'zoom' feature within the simplified XML, and I have it working. I am simply attempting to reformat the
$selection.earliest$ and $selection.latest$ to human readable time instead of EPOCH time in order to stick it in the title of the XML panel.
Can that be done, or maybe there is another field(s) I can use to display human readable time?
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@dolivasoh, @pamcarvalho, Use the <eval> tag to convert $start$ and $end$ selection times to String time using strftime() function:
<selection>
...
...
...
<eval token="selEarlStr">strftime($start$,"%Y/%m/%d %H:%M:%S %p")</eval>
<eval token="selLatStr">strftime($end$,"%Y/%m/%d %H:%M:%S %p")</eval>
</selection>
Then use the $selEarlStr$ and $selLatStr$ tokens to display selected time in String format.
<html>
...
...
<code>New Selected Time Range (String): $selEarlStr$ - $selLatStr$</code>
...
</html>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use convert() to achieve this.
Syntax
convert timeformat=string...
Required arguments
Syntax: auto() | ctime() | dur2sec() | memk() | mktime() | mstime() | none() | num() | rmcomma() | rmunit()
Description: Functions for convert.
ctime()
Syntax: ctime(
Description: Convert an epoch time to an ascii human readable time. Use the timeformat option to specify exact format to convert to.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This would need to be done in a dashboard panel 'title' screen. I'm not running a search there unfortunately.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any solution for this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
l know it has been 2 years, but does anyone know how to do that? I am using drilldown to get data value, but when I put the value as the title, it is in Epoch, and I need it to be in human format in the table.. Can anyone help me with that?
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
