Dashboards & Visualizations

How do you transform a subsearch into a string literal and not SPL?

pcatasus
Engager

I have a token I want to set up when I first init dashboard:
[stats count | eval search=strftime(now(), "mysearch%y%m%d%H%M%S.csv")]
But this gets interpreted dynamically throughout changing the name of the file. I just want to have a timestamp literal I can reuse. Been at it for a while using fieldformat, print, etc. Thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

You can init strftime(now(), "mysearch%y%m%d%H%M%S.csv") first then use it in the actual token.

<init>
    <eval token="filename">strftime(now(), "mysearch%y%m%d%H%M%S.csv")</eval>
    <set token="search">[stats count | eval search=$filename$]</set>
  </init>

View solution in original post

manjunathmeti
Champion

You can init strftime(now(), "mysearch%y%m%d%H%M%S.csv") first then use it in the actual token.

<init>
    <eval token="filename">strftime(now(), "mysearch%y%m%d%H%M%S.csv")</eval>
    <set token="search">[stats count | eval search=$filename$]</set>
  </init>

pcatasus
Engager

Worked like a charm! Thank you!

0 Karma

manjunathmeti
Champion

Please accept answer.

0 Karma

pcatasus
Engager

Sorry! Done.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...