Dashboards & Visualizations

Dashboard not showing date correctly

balash1979
Path Finder

I am using the following code in my dashboard

 <search>
 <query>| makeresults</query>
 <earliest>$field1.earliest$</earliest>
 <latest>$field1.latest$</latest>
 <done>
  <eval token="tokTime">$job.earliestTime$</eval>
  <eval token="tokEarliestTime">strftime(strptime($job.earliestTime$,"%Y/%m/%dT%H:%M:%S %p"),"%m/%d/%y %I:%M:%S %p") 
 </eval>
  <eval token="tokLatestTime">strftime(strptime($job.latestTime$,"%Y/%m/%dT%H:%M:%S %p"),"%m/%d/%y %I:%M:%S %p")</eval>
</done>
</search>

In my panel, i use this

<title>from $tokEarliestTime$ to $tokLatestTime$</title>

When I save my dashboard it shows up as
from invalid date to invalid date

Do I need to change any personal settings in splunk to get this working ?

Tags (1)
0 Karma

vnravikumar
Champion

Hi

Try this

<form>
  <label>date</label>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>from $tokEarliest$ to $tokLatest$</title>
      <table>
        <search>
          <query>| makeresults</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <done>
            <eval token="tokTime">$job.earliestTime$</eval>
            <eval token="tokEarliest">strftime(strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S %p")</eval>
            <eval token="tokLatest">strftime(strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S %p")</eval>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

woodcock
Esteemed Legend

Try this:

<search>
 <query>| makeresults</query>
 <earliest>$field1.earliest$</earliest>
 <latest>$field1.latest$</latest>
 <done>
  <eval token="tokTime">$job.earliestTime$</eval>
  <eval token="tokEarliestTime">strftime($job.earliestTime$,"%Y/%m/%dT%H:%M:%S %p")</eval>
  <eval token="tokLatestTime">strftime($job.latestTime$,"%Y/%m/%dT%H:%M:%S %p")</eval>
</done>

And then this:

<title>from $tokEarliestTime$ to $tokLatestTime$</title>
0 Karma

balash1979
Path Finder

Same issue as before. it says invalid date in the dashboard.
Sounds like some server side settings that need to change ?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...