If I have a simple dashboard with a time range picker input, how can I add source code to convert the picker selection to a StartDate and EndDate token. StartDate = strftime(earliest, %m/%d/%Y %H:%M:%S), EndDate=strftime(latest, %m/%d/%Y %H:%M:%S)
{
"visualizations": {
"viz_ZgRiQCoQ": {
"type": "viz.column",
"options": {},
"dataSources": {
"primary": "ds_GHdtwfg5"
}
}
},
"dataSources": {
"ds_GHdtwfg5": {
"type": "ds.search",
"options": {
"query": "index=_internal \n| top 100 sourcetype"
},
"name": "Search_1"
}
},
"defaults": {
"dataSources": {
"global": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
},
"visualizations": {
"global": {
"showLastUpdated": true
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-24h@h,now"
},
"title": "Global Time Range"
}
},
"layout": {
"type": "absolute",
"options": {},
"structure": [
{
"item": "viz_ZgRiQCoQ",
"type": "block",
"position": {
"x": 0,
"y": 0,
"w": 300,
"h": 300
}
}
],
"globalInputs": [
"input_global_trp"
]
},
"title": "Global time range picker",
"description": ""
}
And then be able to display StartDate and EndDate on the top of the dashboard, so if the user selects Last 24 hrs or Last 30 days - it can be displayed as 09/12/2022 - 09/13/2022 or 08/14/2022 - 09/13/2022?
The way you would solve this in XML would be to add this global search to your XML
<search>
<query>
| makeresults
| addinfo
| eval StartDate = strftime(info_min_time, "%m/%d/%Y %H:%M:%S"), EndDate = strftime(info_max_time, "%m/%d/%Y %H:%M:%S")
</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<done>
<set token="start">$result.StartDate$</set>
<set token="end">$result.EndDate$</set>
</done>
</search>
which uses addinfo to "convert" the time picker selection to info_X_time fields, which are epoch times and you can then strftime those and set tokens.
However, in dashboard studio, I don't know if these base searches/token mechanisms are yet supported.
If not, I guess you can still use a search that does the above SPL and make the start and end fields single value fields that show the relevant date string.