How to use eval on a token from a time picker and add it to a label for a chart?

[KevinAdu]

In my Splunk Dashboard, I have a time picker and charts which shows a search for each subsequent day from the earliest time selected in the time picker.

I want to display a formatted date in a label for each chart. So for example:

Day 1 - 15/12/2015
Day 2 - 16/12/2015
Day 3 - 17/12/2015
etc

I understand that these dates can be derived from the time picker's token. Here is what I have attempted so far just for the first date but it does not seem to work:

<input type="time" token="InputTime">
      <label>TimePicker for SourceType</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <eval token="new_time">strptime($InputTime.earliest$, "%m/%d/%Y")</eval>
        <title>Day 1 - $new_time$</title>

Could anybody tell me what I am doing wrong?
Thanks

[gcusello]

Try to insert eval command in the search of a panel and then extract the token in the panel and show it in the panel's title.
But if you do this, you have to manage the showed columns to don't see the value in a column: in this case you have to use the <fields> option
Bye.
Giuseppe

[JovanMilosevic · Accepted solution]

I know it's been a while, but might help someone else. Just been wrestling with similar problem. I've found that evals need to be inside the input block. Also, when tokens are used there, they need to be in single quotes. Finally, it's strftime rather than strptime. Try...

<input type="time" token="InputTime">
       <label>TimePicker for SourceType</label>
       <default>
         <earliest>-15m</earliest>
         <latest>now</latest>
       </default>
       <change>
         <eval token="new_time">strftime('InputTime.earliest', "%m/%d/%Y")</eval> 
       </change>
  </input>
   </fieldset>
   <row>
     <panel>
       <chart>
         <title>Day 1 - $new_time$</title>

[rmarcum]

Hi JovanMilosevic, did this indeed work for you? We are looking for your secret. (-: Please check question:

https://answers.splunk.com/answers/425146/simple-xml-dashboard-eval-strptime-using-old-value.html

Best Regards

[masonmorales]

I'm not sure if you can perform an eval on a time token to convert it to another time format... I know that you can do this though:

 <input type="time" token="InputTime">
       <label>TimePicker for SourceType</label>
       <default>
         <earliest>-15m</earliest>
         <latest>now</latest>
       </default>
     </input>
   </fieldset>
   <row>
     <panel>
       <chart>
         <title>Day 1 - $InputTime.earliest$ to $InputTime.latest$</title>

[KevinAdu]

Yeah but the issue is that will show it in the unix timestamp format. So I was hoping I could change it to make it more readable.

Where I saw the eval command being used that way was on this page:

http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/tokens