Dashboards & Visualizations

How to format "snap to time" to string in dashboard panel title.

GersonGarcia
Path Finder

Hello all,

I am designing a dashboard that will use a timer pick to build search. I would like to show in the panel title the time in the same format as any Search:

7/6/17 9:00:00.000 AM to 7/13/17 9:19:00.000 AM

But when I add the timer in the title I am getting the "snap to time" format:

Between $timer.earliest$ and $timer.latest$

=

Between -7d@h and now

Is there anyway I can format it to string? I tried feel combinations, but they didn't work:

1st:

  <row>
    <panel>
      <title>Select Desired Time of oom-killer Invocation</title>
      <table>
        <title>Between strftime($timer.earliest$,"%c") and strftime($timer.latest$,"%c")</title>
        <search>


Output:

Between strftime(-7d@h,"%c") and strftime(now,"%c")

2nd:

    <input type="time" token="timer" searchWhenChanged="true">
      <label>Timeframe</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <unset token="SearchHost"></unset>
        <unset token="tssnservice"></unset>
        <eval token="searliest">strftime(earliest,"%c")</eval>
        <eval token="slatest">strftime(latest,"%c")</eval>
      </change>
    </input>
...

      <table>
        <title>Between $searliest$ and $slatest$</title>
        <search>
...


OUTPUT:

Between Invalid date and Invalid date

and...

    <input type="time" token="timer" searchWhenChanged="true">
      <label>Timeframe</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <unset token="SearchHost"></unset>
        <unset token="tssnservice"></unset>
        <eval token="searliest">'strftime(earliest,"%c")'</eval>
        <eval token="slatest">'strftime(latest,"%c")'</eval>
      </change>
    </input>
...
      <table>
        <title>Between $searliest$ and $slatest$</title>
        <search>
...

OUTPUT:

Between $searliest$ and $slatest$

Is there any other option?

Thank you,

Gerson

0 Karma

rgaffur
Explorer

Second attempt...
We need to check if the timepicker variable is an Epoch number or a Splunk artifact like “-7d@d” or “now”.
If the variable is an Epoch number, we convert it to a date using strftime.
If the variable is a String, we need to convert it into an Epoch number using relative_time, then into a date.

      <earliest>$command_token.earliest$</earliest>
      <latest>$command_token.latest$</latest>
      <progress>
        <eval token="allCommandsEarliestLabel">
          if(isnum($command_token.earliest$),strftime($command_token.earliest$,"%d/%m/%Y %H:%M:%S"),strftime(relative_time(now(), $command_token.earliest$),"%m/%d/%Y %H:%M:%S"))
        </eval>
        <eval token="allCommandsLatestLabel">
          if(isnum($command_token.latest$),strftime($command_token.latest$,"%m/%d/%Y %H:%M:%S"),strftime(relative_time(now(), "@sec"),"%m/%d/%Y %H:%M:%S"))
        </eval>
      </progress>
0 Karma

rgaffur
Explorer

First attempt...

  <title>All Commands Last from $allCommandsEarliestLabel$ to $allCommandsLatestLabel$</title>
  <chart id="allCommandMaster">
    <search id="passBaseSearch">
      <query>index=...|stats count by command</query>
      <earliest>$command_token.earliest$</earliest>
      <latest>$command_token.latest$</latest>
      <progress>
        <eval token="allCommandsEarliestLabel">if(isnum($command_token.earliest$),strftime($command_token.earliest$,"%d/%m/%Y %H:%M:%S"),$command_token.earliest$)</eval>
        <eval token="allCommandsLatestLabel">if(isnum($command_token.latest$),strftime($command_token.latest$,"%d/%m/%Y %H:%M:%S"),$command_token.latest$)</eval>
      </progress>
    </search>
0 Karma

GersonGarcia
Path Finder

No, that is not what the timer pick sets. it sets 2 variables:

        <earliest>-7d@h</earliest>
        <latest>now</latest>

The provided code works for dropdown lists.

Thank you,

0 Karma

sbbadri
Motivator
  <label>Time Range:</label>
  <default>
    <earliestTime>-1d@d</earliestTime>
    <latestTime>@d</latestTime>
  </default>
  <change>
      <!-- use predefined input tokens to set -->
      <!-- tokens for the selected label and value -->
      <set token="date_label">$label$</set>
      <set token="earliest_tok">$value$</set>
  </change>
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...