Dashboards & Visualizations

Dashboard search "eval" token returns wrong result, same code gets right answer when run in search window

Contributor

In my dashboard:

<dashboard>
  <label>...</label>
  <search id="basesearch">
    <query>...</query>
    <earliest>-7d@w1</earliest>
    <latest>@w1</latest>
    <preview>
      <eval token="earliest_token">$job.request.earliest_time$</eval>
      <eval token="earliest_token2">strftime( relative_time( now(), $job.request.earliest_time$ ), "%d/%m/%Y %H:%M" )</eval>
    </preview>
  </search>
  <row>
    <panel depends="$earliest_token$">
      <html>
        <p>Earliest $earliest_token$ converts to $earliest_token2$</p>
      </html>
    </panel>
  </row>
  ...

This displays:

Earliest -7d@w1 converts to 05/07/2016 00:00

Which is wrong: It should be the 4th of July. The other panels in the dashboard, all fed by the base search, are indeed showing data starting from the 4th of July. And if I run this in a regular search window:

| stats count | eval count=strftime( relative_time( now(), "-7d@w1" ), "%c" )

I get the right result:

Mon Jul 4 00:00:00 2016

So why is my dashboard eval lying?

Legend

I just test this, & I get Earliest -7d@w1 converts to 04/07/2016 00:00

<dashboard>
   <label>...</label>
   <search id="basesearch">
     <query>index=_internal | head 1</query>
     <earliest>-7d@w1</earliest>
     <latest>@w1</latest>
     <preview>
       <eval token="earliest_token">$job.request.earliest_time$</eval>
       <eval token="earliest_token2">strftime( relative_time( now(), $job.request.earliest_time$ ), "%d/%m/%Y %H:%M" )</eval>
     </preview>
   </search>
   <row>
     <panel depends="$earliest_token$">
       <html>
         <p>Earliest $earliest_token$ converts to $earliest_token2$</p>
       </html>
     </panel>
   </row>
</dashboard>
0 Karma

Contributor

I can't see any difference in your code, compared to mine, so I'm guessing what you're saying is "WFM"? 😞

0 Karma

Legend

I copied your code 🙂

0 Karma