Dashboards & Visualizations

Dynamically passing time-picker token in startime for "|gentimes"

egonstep
Path Finder

Hello all, I have a dashboard and I need the "|gentimes" command to generate dynamic values accordingly to the selected time picker. Picking up the earliest event from the search.

 | gentimes start=$field1.earliest$ increment=3h
 | convert timeformat="%Y/%m/%d - %H" ctime(starttime)
 | rename starttime as date
 | table date

I tried to search inside the start argument but It throws an error:

   [subsearch]: command="gentimes", generatetimestamps requires start=mm/dd/yyyy:hh:mm:ss and optional takes 'end' and  'increment' values

The full query (with gentimes error):

base search
| append
    [| gentimes start= [search "base search"
     | tail 1
     | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as dt
     | eval firstEvent = dt
     | return $firstEvent] increment=3h
 | convert timeformat="%Y/%m/%d - %H" ctime(starttime)
 | rename starttime as defaultDate
 | table defaultDate]

Thanks.

0 Karma

cmerriman
Super Champion

Make the subsearch in gentimes into a post process/base search and pass a token. I believe the reason it doesn't work is the way that it passes the argument.

<dashboard>
......
        <search>
         <query>"base search"
      | tail 1
      | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as dt
      | return $dt</query> 
          <done>
            <set token="token">$result.dt$</set>
          </done>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
  <row>
    <panel>
      <table>
        <search>
          <query>base search
 | append
     [| gentimes start=$token$  increment=3h| convert timeformat="%Y/%m/%d - %H" ctime(starttime)
  | rename starttime as defaultDate
  | table defaultDate]</query>
.........
</dashboard>
0 Karma

egonstep
Path Finder

@cmerriman Thanks for your response. But unfortunately, it throws another error:

[subsearch]: command='gentimes', invalid literal for int() with base 10: "$result.dt$"
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...