Dashboards & Visualizations

How do you transform a subsearch into a string literal and not SPL?

pcatasus
Engager

I have a token I want to set up when I first init dashboard:
[stats count | eval search=strftime(now(), "mysearch%y%m%d%H%M%S.csv")]
But this gets interpreted dynamically throughout changing the name of the file. I just want to have a timestamp literal I can reuse. Been at it for a while using fieldformat, print, etc. Thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

You can init strftime(now(), "mysearch%y%m%d%H%M%S.csv") first then use it in the actual token.

<init>
    <eval token="filename">strftime(now(), "mysearch%y%m%d%H%M%S.csv")</eval>
    <set token="search">[stats count | eval search=$filename$]</set>
  </init>

View solution in original post

manjunathmeti
Champion

You can init strftime(now(), "mysearch%y%m%d%H%M%S.csv") first then use it in the actual token.

<init>
    <eval token="filename">strftime(now(), "mysearch%y%m%d%H%M%S.csv")</eval>
    <set token="search">[stats count | eval search=$filename$]</set>
  </init>

pcatasus
Engager

Worked like a charm! Thank you!

0 Karma

manjunathmeti
Champion

Please accept answer.

0 Karma

pcatasus
Engager

Sorry! Done.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...