How to convert time based on selected time span token?

[auaave]

Hi Guys,

I am creating a dashboard with time span token $bin$ = 1h or 1w or 1d or 1m. How can I convert the time based on the selected token? 1h - %H , 1d - %d , 1w - %V , 1m - %b

Thanks!

| search $group$
| bin _time span=$bin$ 
| eval Time=strftime(_time,"%V") 
| chart count as eventcount over DESCRIPTION by Time 

[HiroshiSatoh · Accepted solution]

Is it like this?
Please add CASE.

<input type="dropdown" token="span">
  <label>XXX</label>
  <choice value="1h">1h</choice>
  <choice value="1d">1d</choice>
  <change>
    <eval token="time_format">case($span$="1h","%H",$span$="1d","%d")</eval>
  </change>
</input>

|eval Time=strftime(_time,"$time_format$")

[auaave]

@HiroshiSatoh, this is exactly what I need. Thanks a lot 🙂

[p_gurav]

Hi,

This link will helpful for you:
https://answers.splunk.com/answers/576752/how-to-compare-time-range-picker-to-change-span-of.html

[auaave]

thanks @ p_gurav 🙂