Dashboards & Visualizations

Invalid Date using Job in the UI

sangs8788
Communicator

@niketn 

I am trying to display the selected start and end time in the UI. I followed particularly the below answer given by you. 

https://community.splunk.com/t5/Dashboards-Visualizations/Setting-job-earliestTime-and-job-latestTim...

It was working fine but suddenly it stopped saying Invalid Date. We recently had a splunk Upgrade to Version:8.0.4.1. Could it be due to the upgrade? Was there any change. I couldnt narrow down to exact issue.

Here is the code which you have shared

 

<form>
  <label>Show Time from Time Picker</label>
  <!-- Dummy search to pull selected time range earliest and latest date/time -->
  <search>
    <query>| makeresults | addinfo </query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <done>
      <eval token="tokEarliestTime">strftime(strptime('$job.earliestTime$',"%Y/%m/%dT%H:%M:%S.%3N %p"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>
      <eval token="tokLatestTime">strftime(strptime('$job.latestTime$',"%Y/%m/%dT%H:%M:%S.%3N %p"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <!-- sample HTML Panel to display results in required format -->
      <html>
        (  $tokEarliestTime$ to $tokLatestTime$)
      </html>
    </panel>
  </row>
</form>

 

Attaching the screenshot of what is shown in the UI. Could you please suggest. 

Labels (2)
Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sangs8788 

Try this,

<form>
  <label>Show Time from Time Picker</label>
  <!-- Dummy search to pull selected time range earliest and latest date/time -->
  <search>
    <query>| makeresults | addinfo</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <done>
      <eval token="tokEarliestTime">strftime($result.info_min_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
      <eval token="tokLatestTime">strftime($result.info_max_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    
  </fieldset>
  <row>
    <panel>
      <!-- sample HTML Panel to display results in required format -->
      <html>
        (  $tokEarliestTime$ to $tokLatestTime$)
      </html>
    </panel>
  </row>
</form>

 

Screenshot 2021-07-19 at 5.05.52 PM.png

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sangs8788 

Try this,

<form>
  <label>Show Time from Time Picker</label>
  <!-- Dummy search to pull selected time range earliest and latest date/time -->
  <search>
    <query>| makeresults | addinfo</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <done>
      <eval token="tokEarliestTime">strftime($result.info_min_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
      <eval token="tokLatestTime">strftime($result.info_max_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    
  </fieldset>
  <row>
    <panel>
      <!-- sample HTML Panel to display results in required format -->
      <html>
        (  $tokEarliestTime$ to $tokLatestTime$)
      </html>
    </panel>
  </row>
</form>

 

Screenshot 2021-07-19 at 5.05.52 PM.png

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

sangs8788
Communicator

This works. Thanks for looking into this.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Hi

Replace the eval lines with this ones:

<eval token="tokEarliestTime">strftime(strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>
<eval token="tokLatestTime">strftime(strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>

 

Also, I'm sad to say that Niket is no longer with us. He passed away last year.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

sangs8788
Communicator

This doesnt work either

0 Karma

sangs8788
Communicator

I am so sorry hear that. I didnt know. May his soul rest in peace. Didnt expect

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...