Dashboards & Visualizations

Dynamically passing time-picker token in startime for "|gentimes"

egonstep
Path Finder

Hello all, I have a dashboard and I need the "|gentimes" command to generate dynamic values accordingly to the selected time picker. Picking up the earliest event from the search.

 | gentimes start=$field1.earliest$ increment=3h
 | convert timeformat="%Y/%m/%d - %H" ctime(starttime)
 | rename starttime as date
 | table date

I tried to search inside the start argument but It throws an error:

   [subsearch]: command="gentimes", generatetimestamps requires start=mm/dd/yyyy:hh:mm:ss and optional takes 'end' and  'increment' values

The full query (with gentimes error):

base search
| append
    [| gentimes start= [search "base search"
     | tail 1
     | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as dt
     | eval firstEvent = dt
     | return $firstEvent] increment=3h
 | convert timeformat="%Y/%m/%d - %H" ctime(starttime)
 | rename starttime as defaultDate
 | table defaultDate]

Thanks.

0 Karma

cmerriman
Super Champion

Make the subsearch in gentimes into a post process/base search and pass a token. I believe the reason it doesn't work is the way that it passes the argument.

<dashboard>
......
        <search>
         <query>"base search"
      | tail 1
      | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as dt
      | return $dt</query> 
          <done>
            <set token="token">$result.dt$</set>
          </done>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
  <row>
    <panel>
      <table>
        <search>
          <query>base search
 | append
     [| gentimes start=$token$  increment=3h| convert timeformat="%Y/%m/%d - %H" ctime(starttime)
  | rename starttime as defaultDate
  | table defaultDate]</query>
.........
</dashboard>
0 Karma

egonstep
Path Finder

@cmerriman Thanks for your response. But unfortunately, it throws another error:

[subsearch]: command='gentimes', invalid literal for int() with base 10: "$result.dt$"
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...