Dashboards & Visualizations

How to display the label from the time field token from the time picker?

dbcase
Motivator

Hi,

I would like to display the label from the time field token from the time picker. I can display the value by using (timefield).earliest but it shows up as -24h@h which is sorta readable but not as good as Last 24 hrs. How can I display the label vs the value?

0 Karma
1 Solution

niketnilay
Legend

@dbcase case, please refer to one of my recent answers. Hope you are looking for the same: https://answers.splunk.com/answers/633356/whats-the-token-name-for-the-time-pickers-display.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@dbcase case, please refer to one of my recent answers. Hope you are looking for the same: https://answers.splunk.com/answers/633356/whats-the-token-name-for-the-time-pickers-display.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

dbcase
Motivator

Hi Niketnialy,

This one worked perfect

  <input type="time" searchWhenChanged="true">
       <label>Enter time range</label>
       <default>
         <earliest>-1d@d</earliest>
         <latest>@d</latest>
       </default>
       <change>
         <set token="displayTime">($label$)</set>
       </change>
     </input>
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...