Dashboards & Visualizations

How to convert time based on selected time span token?

auaave
Communicator

Hi Guys,

I am creating a dashboard with time span token $bin$ = 1h or 1w or 1d or 1m. How can I convert the time based on the selected token? 1h - %H , 1d - %d , 1w - %V , 1m - %b

Thanks!

| search $group$
| bin _time span=$bin$ 
| eval Time=strftime(_time,"%V") 
| chart count as eventcount over DESCRIPTION by Time 
0 Karma
1 Solution

HiroshiSatoh
Champion

Is it like this?
Please add CASE.

<input type="dropdown" token="span">
  <label>XXX</label>
  <choice value="1h">1h</choice>
  <choice value="1d">1d</choice>
  <change>
    <eval token="time_format">case($span$="1h","%H",$span$="1d","%d")</eval>
  </change>
</input>

|eval Time=strftime(_time,"$time_format$")

View solution in original post

HiroshiSatoh
Champion

Is it like this?
Please add CASE.

<input type="dropdown" token="span">
  <label>XXX</label>
  <choice value="1h">1h</choice>
  <choice value="1d">1d</choice>
  <change>
    <eval token="time_format">case($span$="1h","%H",$span$="1d","%d")</eval>
  </change>
</input>

|eval Time=strftime(_time,"$time_format$")

auaave
Communicator

@HiroshiSatoh, this is exactly what I need. Thanks a lot 🙂

0 Karma

p_gurav
Champion
0 Karma

auaave
Communicator

thanks @ p_gurav 🙂

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>