Dashboards & Visualizations

Dynamically passing time-picker token in startime for "|gentimes"

egonstep
Path Finder

Hello all, I have a dashboard and I need the "|gentimes" command to generate dynamic values accordingly to the selected time picker. Picking up the earliest event from the search.

 | gentimes start=$field1.earliest$ increment=3h
 | convert timeformat="%Y/%m/%d - %H" ctime(starttime)
 | rename starttime as date
 | table date

I tried to search inside the start argument but It throws an error:

   [subsearch]: command="gentimes", generatetimestamps requires start=mm/dd/yyyy:hh:mm:ss and optional takes 'end' and  'increment' values

The full query (with gentimes error):

base search
| append
    [| gentimes start= [search "base search"
     | tail 1
     | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as dt
     | eval firstEvent = dt
     | return $firstEvent] increment=3h
 | convert timeformat="%Y/%m/%d - %H" ctime(starttime)
 | rename starttime as defaultDate
 | table defaultDate]

Thanks.

0 Karma

cmerriman
Super Champion

Make the subsearch in gentimes into a post process/base search and pass a token. I believe the reason it doesn't work is the way that it passes the argument.

<dashboard>
......
        <search>
         <query>"base search"
      | tail 1
      | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as dt
      | return $dt</query> 
          <done>
            <set token="token">$result.dt$</set>
          </done>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
  <row>
    <panel>
      <table>
        <search>
          <query>base search
 | append
     [| gentimes start=$token$  increment=3h| convert timeformat="%Y/%m/%d - %H" ctime(starttime)
  | rename starttime as defaultDate
  | table defaultDate]</query>
.........
</dashboard>
0 Karma

egonstep
Path Finder

@cmerriman Thanks for your response. But unfortunately, it throws another error:

[subsearch]: command='gentimes', invalid literal for int() with base 10: "$result.dt$"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...